BWH Hotels Confirms Cyberattack, Exposing Customer Data in 2026 Breach BWH Hotels, a global hospitality chain operating over 4,300 properties across 100+ countries, confirmed a cyberattack on April 22, 2026, resulting in the theft of sensitive customer data. The breach targeted a vulnerable web application storing guest reservation information, exposing names, email addresses, phone numbers, postal addresses, and reservation details including stay dates and special requests. Data compromised spanned records generated between October 14, 2025, and April 22, 2026, though the duration of the attackers’ undetected access remains unclear. Notably, payment and banking details were not affected, as the compromised system did not store such information. Upon discovery, BWH Hotels took the application offline, revoked unauthorized access, and engaged external cybersecurity experts to investigate and reinforce security measures. The company also warned customers to remain cautious of phishing attempts, advising against interacting with suspicious communications referencing hotel stays or reservations. BWH Hotels serves as the parent company for brands including Best Western Hotels & Resorts, WorldHotels, and SureStay Hotels, with annual revenues exceeding $8.5 billion. The incident underscores the ongoing risks to hospitality data, particularly in systems handling guest reservations.

BWH Hotels Discloses Third-Party Data Breach Affecting Guest Information BWH Hotels, the parent company of brands including WorldHotels, Best Western Hotels & Resorts, and Sure Hotels, has notified customers of a third-party data breach exposing six months of guest reservation data. The intrusion was detected on April 22, 2025, but the compromised data spans from October 14, 2024, to the discovery date. According to CTO Bill Ryan, unauthorized access targeted a web application storing guest reservation details. Exposed information includes names, email addresses, phone numbers, home addresses, reservation numbers, stay dates, and special requests. The company confirmed that no payment or banking details were accessed. The breach’s timeline remains unclear whether the attack began in October and went undetected or if a later incident exposed archived data. BWH Hotels has not responded to inquiries about potential ties to a March 2025 report of stolen booking data being used in phishing campaigns, which the company previously neither confirmed nor denied. Upon discovery, BWH Hotels took the affected application offline, revoked unauthorized access, and engaged external cybersecurity experts to bolster defenses. The company has not disclosed the number of affected guests.