Massive Data Leak Exposes Nearly 5 Million Hospitality Guests in Spain and Austria Security researchers at Cybernews uncovered a major data breach involving Spanish and Austrian hospitality platforms, exposing nearly 5 million users’ personal information. The incident stemmed from an attacker who compromised 527 accounts belonging to hotels and hosts, using them to extract sensitive data via automated Python scripts. The stolen data totaling 6.5GB was left unprotected on an open server, allowing researchers to access it. The breach affected platforms like Chekin (a Spain-based automated check-in service) and Gastrodat (an Austrian hotel management software provider), with records pulled from over 170 facilities worldwide. The exposed data includes guest names, email addresses, phone numbers, birth details, ID document numbers, reservation IDs, stay dates, and property addresses. In some cases, internal safety flags and account credentials including JWT tokens were also compromised. Gastrodat alone accounted for 361,000 booking records (11.6 million entries), while Chekin exposed 311,400 records, including 253,000 ID document numbers. The attacker used Telegram to forward the stolen data in real time, though the unsecured server ultimately led to its discovery. The scale of the leak highlights vulnerabilities in hospitality sector security, with millions of travelers and guests now at risk of identity theft and fraud.