Bookeasy, the Australian tourism booking platform that runs the national parks booking systems for Queensland, Victoria and South Australia, has confirmed that an attacker accessed parts of its platform and that some customers’ personal and booking details have or may have been accessed. Parks Victoria has suspended all new campsite bookings, and park agencies in all 3 states are warning campers about scam messages that may use the stolen details.
The breach comes just weeks before the Christmas holiday peak, when national park campgrounds are at their busiest. No agency has said how many people are affected.
What Bookeasy says happened
In a status update last updated on November 11, 2026, Bookeasy said it detected “unauthorised activity within the Bookeasy platform” after a security alert, took immediate containment action and brought in outside cyber experts to investigate. The company said it first detected the issue in early November.
According to Bookeasy, the personal information involved includes names, home addresses, email addresses and phone numbers, along with booking information. The company said that, based on its investigation so far, it has not identified any access to credit card details. It also warned that “the nature of these incidents may mean that gaining certainty over what was accessed is not always possible.”
Bookeasy said it believes the issue is resolved and that an external third-party expert is validating its containment work. The platform is still operating. The company has not said how the attacker got in, how many partners are affected or how many customer records were involved.
Bookeasy is based on the Gold Coast and has been part of the G’day Group, the company behind the Discovery Parks holiday park chain, since 2024. Its platform is used by visitor centres, tourism operators and government agencies across Australia, so the impact could reach well beyond national parks. Bookeasy said it is contacting the partners and operators it knows are or may be affected, and that partners who have not heard from it have no direct evidence of their customers’ data being accessed.
Parks Victoria pauses new campsite bookings
Parks Victoria said on November 11 that it was aware of “a broader data breach involving Bookeasy” and of suspicious WhatsApp messages being sent to some customers about their Parks Victoria bookings. As a precaution, it temporarily suspended all new campsite bookings while it investigates with Bookeasy.
Existing bookings have not been cancelled and remain valid, but customers temporarily cannot change or modify them. Parks Victoria said it does not contact customers through WhatsApp and does not request payment details that way.
Queensland and South Australia warn of phishing
Queensland’s Department of the Environment, Tourism, Science and Innovation (DETSI) said in a statement issued November 11 that it is investigating a data breach involving Bookeasy, which manages the Queensland National Parks Booking Service. The department said it does not believe financial information was accessed, because payments are processed separately through a secure system, and that it is contacting affected customers directly.
DETSI warned customers not to respond to unexpected emails, texts or phone calls that claim to be from the department and ask for personal information. Suspicious messages can be reported to Queensland Parks and Wildlife Service at QPWS@detsi.qld.gov.au.
National Parks and Wildlife Service South Australia emailed its users that Bookeasy had detected unauthorised activity and that names, contact details and booking information may have been accessed, according to reports. The email said there was no evidence at this stage that credit card details were accessed.
The incident also reaches outside the parks systems. The Shire of Carnarvon in Western Australia posted a security alert on November 11 saying the Carnarvon Visitor Centre, which uses Bookeasy for visitor bookings, was told about the incident and that suspicious WhatsApp messages are circulating about bookings. As of November 12, there was no public confirmation that New South Wales national park customers were affected, according to reports.
Scam messages are already circulating
Bookeasy itself said it is aware of suspicious activity that may be linked to the incident, “including some customers receiving phishing messages via WhatsApp.” It has advised affected partners to warn customers with upcoming bookings, and to consider warning anyone who booked in the past 12 months.
Scammers who hold real names, dates and booking references can send messages that look genuine. A message that quotes your actual booking is not proof that it came from the park or the booking provider.
Bookeasy said there is no connection, based on its investigation so far, to the recent security incident at RMS, another Australian booking software provider. RMS said it identified unauthorised access on October 26 that involved guest contact information and booking details, and that guests were then targeted by WhatsApp, text and email messages quoting real bookings and asking for card details. The pattern is similar to the reservation scams that followed the Booking.com guest reservation data breach.
No group has claimed the attack
As of November 12, no ransomware or extortion group had publicly claimed the Bookeasy breach, and Bookeasy has not said whether it received a ransom demand. None of the agencies or the company has said publicly whether the Office of the Australian Information Commissioner (OAIC) has been notified.
What park visitors should do
- Do not click links, reply to, or make payments in response to unexpected WhatsApp messages, texts, emails or calls about a park booking, even if they quote your real booking details.
- Check any request by contacting the park agency or booking provider directly, using contact details from its official website or your original confirmation.
- If you clicked a link, run an antivirus scan on your device and change your passwords, starting with your email account.
- If you entered card or bank details, contact your bank straight away and watch your statements.
- Report suspicious messages to the park agency, and to Scamwatch at scamwatch.gov.au.
Travel booking platforms have become a frequent target because the data they hold makes scams easy to personalize. In late October, attackers also reached airline booking data through Amadeus. BreachNews will update this story if Bookeasy or the park agencies release the number of affected customers.
