Kempinski notified upcoming guests that an unauthorised party misused a technology partner’s access credential to view a portion of reservation records, latribunedelhotellerie.com reported.
The hotel group revoked the compromised credential and closed the unauthorised access path upon discovering the security incident. Investigators launched an inquiry alongside an independent cybersecurity specialist to examine the scope of the breach.
A corporate spokesperson confirmed to the German news agency dpa that the Hotel Adlon Kempinski Berlin, situated opposite the Brandenburg Gate, is among the properties affected by the incident.
Exposed data points include guest names, email addresses, phone numbers, hotel properties, stay dates, and booking confirmation numbers. Payment card data remained secure because the compromised system does not store financial information.
Uncertainty Remains over Passport and Visa Data Exposure
Investigators remain cautious regarding sensitive personal details contained within the booking files. The organisation stated it can neither confirm nor exclude whether passport or visa numbers were accessed during the breach.
Bookings across the network remain fully confirmed despite the security event. Management has not disclosed the total number of affected guests or the commercial identity of the third-party technology vendor involved.
The incident follows broader industry trends highlighted by Check Point, an Israeli cybersecurity firm reporting a 50 percent increase in attacks targeting the hospitality, travel, and leisure sectors throughout 2025.
Cybercriminals Impersonate Properties to Demand Payments via Messaging Apps
Cybercriminals have contacted guests via email, SMS, and WhatsApp while impersonating Kempinski properties. These fraudulent messages utilize genuine confirmation numbers and stay dates to establish credibility with recipients.
Attackers typically demand payments or request banking credentials via external web links to secure existing reservations. The hospitality group clarified that it never asks customers to verify banking details or send payments through links transmitted over messaging applications.
Affected customers who already transferred funds are advised to block their payment cards, dispute transactions with their banks, file official police reports, and retain all communication evidence. Management established a dedicated email address at breach-notification2026@kempinski.com to help guests verify the legitimacy of suspicious messages.
Third-Party Access Governance Measures
Kempinski is collaborating with the unnamed technology vendor to strengthen security protocols across their shared data ecosystem. Efforts focus specifically on improving credential protection and surveillance mechanisms for external partners.
Questions Concerning Partner Security Controls
Kempinski has not yet disclosed the identity of the technology partner or the exact number of impacted travelers.
Related reading