NightsBridge and LekkeSlaap breaches: how to protect your guests

For an independent guesthouse, lodge or villa business, a convincing booking scam can become a reservations problem before you know anything is wrong. A guest receives a message quoting their stay dates, pays through a fraudulent link and then calls your team for help.

The recent NightsBridge and LekkeSlaap incidents make clear guest communication especially important. Your immediate priority is to help guests recognise suspicious requests, give staff a consistent response and make your official booking and payment process easy to verify.

Updated 10 November 2026: Added NightsBridge’s clarification, more precise payment-related fields and practical guest-warning and reporting guidance.

What happened at NightsBridge and LekkeSlaap?

In MyBroadband’s 5 November 2026 report, NightsBridge managing director Theresa Emerick said unusual activity was identified on 2 November. She said access concerned a back-office channel-booking summary, not the main system, and was stopped a day before phishing began. These are the company’s statements. Its suggestion of AI involvement is not an independently established cause.

The report reproduces a client notice Emerick confirmed as genuine, listing guest contact details, stay dates, references, deposit amounts, total booking amounts and "payment results". Separately, she said there was "no sensitive guest information or payment information". The report does not explain what "payment results" contained or reconcile those descriptions. This does not establish that card details were exposed. Booking and financial context can still make a fraudulent request convincing.

Separately, ITWeb reported on 6 November that LekkeSlaap had detected unauthorised activity in its calendar-syncing system. The company said some guests’ contact details and booking references were accessed, but not payment information, identity numbers or passwords. It said existing bookings remained confirmed. ITWeb reported no indication that the two incidents were linked.

These are reported findings, not confirmation that every property or reservation was affected. Check your provider’s latest notice for your property’s position.

Why a convincing message can still be fraudulent

Scammers can use real booking details to make an unexpected payment request feel routine. A familiar property name or correct reservation number is not proof that a message came from your team.

Champagne Castle Hotel’s public warning describes WhatsApp messages using genuine stay details, sometimes from unfamiliar business names with verified ticks, and demands to act within 24 hours. Guests need an independent way to verify a request, not simply a more convincing-looking message.

A separate RMS Cloud incident affected Australian accommodation providers, as ABC reported. RMS says it identified unauthorised access on 26 October and describes emails, texts, WhatsApp messages and automated calls quoting real booking details. This illustrates a similar fraud pattern, not evidence that these incidents were connected.

How can accommodation owners protect their guests?

1. Confirm what your provider is telling you

Ask which reservations or data fields were involved, what guidance to send guests and where updates will appear. Keep the response with your incident notes. If the scope is unclear, say so; do not tell guests their records were exposed without confirmation, or promise they were unaffected without evidence.

2. Warn relevant guests through established channels

The NightsBridge notice reported by MyBroadband described all future channel-booking records as affected, with exact booking references unavailable at that point. If your property uses the affected service, consider a precautionary warning to upcoming channel-booked guests while confirming scope with NightsBridge. Do not wait silently for an individual booking list, but do not tell every guest their record was definitely exposed.

Use your usual reservations address or agreed platform channel. Explain how to check unexpected requests, without adding a new payment link or asking for sensitive details. Apply LekkeSlaap’s own notice separately; do not assume the same scope for both providers.

3. Make your genuine process easy to check

Review your website’s Contact page, booking confirmations and payment instructions. Show your official reservations number and email clearly, and explain how legitimate payment requests work. Keep details consistent with your booking platforms and Google Business Profile. Guests should use independently found contact details, not those supplied in the suspicious message.

For platform-managed payments, follow that platform’s verified process. LekkeSlaap’s reported guidance is to pay through its platform, not into a different account. A property warning should not redirect those guests to a new direct-payment arrangement, even if you normally accept direct bookings.

4. Give reservations staff one response

Brief everyone who answers calls, email or WhatsApp, including relief staff. Agree who verifies booking status, escalates concerns and records reports. Staff should not click suspicious links to investigate them. Ask for the sender and message details without requesting card numbers, passwords or one-time PINs; share reports only with authorised support teams.

Keep a short handover note so the evening team knows which concerns have already been checked. Record the action taken and the next responsible person, rather than asking a worried guest to repeat their story to every shift.

5. Have an escalation route ready

If a guest entered card details or made a suspicious payment, advise them to contact their bank immediately. Report the message through the relevant platform and your provider’s official support route, found independently rather than through the suspicious message.

Where fraud has occurred, report it to SAPS and retain the case reference. The Southern African Fraud Prevention Service also provides Yima scam-reporting and identity-protection resources. These routes serve different purposes and do not replace urgent bank contact or guarantee recovery. Preserve relevant messages and transaction evidence without circulating personal information widely. Your team can establish booking facts, but should not promise reimbursement or an investigation outcome.

A guest warning you can adapt

Before sending this, replace the bracketed fields and confirm that the wording matches your property’s actual payment arrangements. Do not state that bookings are unchanged unless you have checked. Only if your property can honour it, add: "We will never ask you to pay through a new number, an unexpected link or a different bank account. Please verify any claimed change using our established contact details." Do not use this promise where it conflicts with your normal process.

Dear [Guest name],

We want to help you avoid fraudulent messages about accommodation bookings. A message may quote genuine reservation details and still be a scam.

If you receive an unexpected payment request, cancellation threat or request to confirm card details, pause before responding. Do not use its links or contact details to verify it.

Contact our reservations team using the number on your original confirmation or the official Contact page on [Property website]. We can check the request against your booking and explain the correct payment process.

If you have already shared card details or paid a suspected scammer, contact your bank immediately.

Kind regards, [Property team]

Build confidence beyond this incident

Your website should help guests recognise your business and understand what happens after they book. Accurate contact details, clear confirmations and consistent messaging matter alongside a straightforward booking journey.

Give one person responsibility for keeping those instructions consistent as your provider issues updates. Remove outdated warnings when they no longer apply, without erasing the factual record of an incident.

Direct bookings do not remove every risk: your website may still connect to an external booking engine or payment provider. The goal is a clearer, better-managed guest relationship, not a promise that one channel cannot be compromised. Our booking-system guide explains that connection.

Questions accommodation owners are asking

Are the NightsBridge and LekkeSlaap incidents connected?

ITWeb reported them as separate incidents, with no indication that they were linked. Use each provider’s own guidance rather than assuming the same data, reservations or response applies to both.

Should we cancel upcoming bookings?

Do not assume a data incident invalidates reservations. Check your provider’s notice and each booking’s actual status. LekkeSlaap said existing bookings remained confirmed in the report above; that is not a blanket assurance about every platform or property.

Can we use WhatsApp to warn guests?

Use only channels your property genuinely operates and guests can verify. Some properties use WhatsApp; others do not. A warning should explain your own process, without making promises that conflict with normal operations.

Should we stop taking online bookings?

That decision needs advice from your provider and, where necessary, a qualified security specialist. Do not disable working booking channels solely because of a general news report. Establish your exposure and the recommended response first.

TMSA helps independent accommodation brands improve their websites, guest-facing content and booking journeys. Speak to us about clearer guest communication. Technical incident response belongs with your platform or security specialist. This article is practical communication guidance, not legal advice.