HomeToGo Unit SECRA Says Hackers Took Guest Data

SECRA Bookings, a software subsidiary of holiday-rental group HomeToGo, says attackers broke into its systems and exported data, including information it processes for partners and customers. HomeToGo disclosed the cyber-attack in an ad-hoc statement to investors late on Saturday 24 October, saying the incident involved “unauthorized access to customer data and personally identifiable information”.

SECRA’s own incident notice says the data taken may include names, contact details and dates of birth, and in some cases bank details, ID numbers and the codes for key safes at holiday homes. Neither company has said how many people are affected or who was behind the attack.

In brief

HomeToGo says SECRA Bookings, its channel-management software unit, was hit by a cyber-attack and that customer data and personal information were accessed.
SECRA says it found the attack on 23 October and that attackers exported data, possibly including some IBANs, ID numbers and key-safe codes.
Hosts are being told to reset door PINs and key-safe codes and to treat SECRA integration keys and passwords as compromised.

HomeToGo says the breach stayed inside SECRA

SECRA Bookings provides channel management software, the kind of tool holiday-rental hosts and agencies use to manage listings and bookings across several platforms. In its statement under the EU Market Abuse Regulation, HomeToGo said the incident, “based on current findings”, is isolated to SECRA.

SECRA began containment as soon as it found the attack, securing and isolating the affected systems together with HomeToGo SE and HomeToGo GmbH, and those first steps are complete, the group said. It added that ongoing investigations have “found no evidence of data exfiltration” from systems run by HomeToGo SE or other group companies.

The group said the overall financial impact “cannot yet be reliably quantified”. It said the competent data protection authority would be notified shortly and that notifications to affected parties were being prepared. SECRA’s page, which is undated, says it has already formally notified the relevant data protection authorities.

SECRA lists the data it believes was taken

According to SECRA, its team found on 23 October that its technical infrastructure had been attacked, and that during the unauthorised access the attackers exported data from its systems. The company says it “must assume” the stolen data covers several kinds of personal information (TSN translation):

name, email address, phone number, postal address, date of birth and nationality;
in some cases, bank details (IBAN and BIC), account numbers and ID document numbers;
accessibility information supplied by users, and other details users provided.

For property owners, SECRA warns that access codes, such as combinations for key safes, may also be affected. It says it is instructing all partners to reset electronic-lock PINs and key-safe combinations for affected properties as quickly as possible, and that it has found no sign so far that any data has been misused.

Guests face convincing phishing, and hosts must rotate keys

SECRA warns that data from current bookings could be used for targeted phishing. Criminals could use guests’ real names, arrival dates and the name of the property they booked to make messages look authentic, it says. It tells guests to keep communication and payments on the booking platform, to ignore pressure for urgent payment, and to check bank statements, noting that unauthorised SEPA direct debits can usually be reversed if reported in time.

For hosts, agencies and partners, the advice goes further. SECRA says they should assume that all keys, tokens and passwords linked to their SECRA integration, and their SECRA portal password, have been compromised, and change them straight away.

Booking-related scams are already a regulatory concern in Europe: the European Commission has opened a Digital Services Act case into whether Booking.com does enough to stop them.

A channel manager concentrates other companies’ data

The detail that matters most is SECRA’s own description of what it holds: data processed on behalf of partners and customers. A channel manager sits between hosts, agencies and booking platforms, so a breach there reaches guests who may never have heard of SECRA. That is the same third-party problem TSN described in Sagawa Express’s parcel-data breach, where much of the data that may have leaked concerns shippers’ own customers.

For compliance teams at agencies using SECRA, the integration credentials are the urgent item. If keys and tokens are compromised, the risk is not limited to the stolen records; it extends to anything those credentials could still reach until they are rotated. The key-safe codes are a rare case where a data breach carries a direct physical-security risk, which is why SECRA puts the lock resets first.

The two statements tell slightly different stories

HomeToGo’s investor statement and SECRA’s notice line up on the core facts, but they differ in tone and timing. The ad-hoc speaks of “unauthorized access” and says the regulator will be told shortly; SECRA speaks of data being exported and says regulators have already been notified. The specific list of data types appears only in SECRA’s notice.

What is still missing is scale. Neither company has said how many guests, hosts or agencies are affected, which countries they are in, or how the attackers got in. HomeToGo reports third-quarter results on 12 November, the first scheduled point at which it may put a number on the cost.

The incident joins a run of October breach disclosures, from Treasure Factory’s 746,277 email addresses to Capcom’s 11.77 million email records, that TSN tracks on its ransomware and cyber-attack hub. For guests with an upcoming stay, the practical step is simple: confirm any door code or payment request directly with the host before acting on it.