28 October 2026
Holidaymakers across Australia are being targeted by sophisticated phishing communications linked to a cyber incident involving RMS Cloud, a provider of accommodation and property management software used by holiday parks and tourism operators.
In a security notification, RMS confirmed it was aware of fraudulent communications sent by an unknown party impersonating RMS or its customers. The messages reference genuine booking details and ask recipients to confirm their payment information, making them particularly convincing to people with upcoming holiday reservations.
RMS said the communications may be distributed through email, SMS and WhatsApp. The company is investigating the source of the campaign with assistance from cybersecurity and digital forensics specialists.
Major Australian holiday park operators affected
According to ABC News, major holiday park operators, including Reflections, BIG4 and G’day Parks, are understood to have been affected. News.com.au has also reported that Discovery Parks customers have been targeted.
The use of genuine booking information significantly increases the credibility of these messages. Unlike generic phishing emails, communications that include accurate reservation details, travel dates or accommodation information can be difficult for recipients to distinguish from legitimate customer service messages.
The precise technical cause of the incident remains unclear. RMS has not yet publicly established how the booking information was obtained, whether its own systems were compromised, or the full extent of any unauthorised access. The presence of genuine booking details indicates that information associated with reservations is being used in the campaign, but does not by itself establish how that information was accessed.
RMS issues new integration credentials
In a subsequent status update, RMS said it was continuing to monitor suspicious activity and had issued new credentials to its integration partners as a precaution. The company is working with those partners to complete the credential changes, with some customers and partners expected to be contacted to update their integration details.
RMS also confirmed it was pursuing the removal of websites and contact channels being used in the scam. It is preparing further information for affected properties, including a template they can use to notify guests.
The company explicitly warned that RMS will never ask customers or their guests to provide card details or make payments through WhatsApp.
Further updates are being published on the RMS status page, with additional guidance available in its Security Incident Alert: WhatsApp Phishing Scam.
Potential implications for New Zealand
At the time of writing, no New Zealand sites are known to have been impacted by the incident. However, RMS Cloud is used by accommodation providers in New Zealand, meaning the campaign is relevant to local tourism businesses and their customers.
Examples of New Zealand accommodation websites using RMS Cloud include:
- sundaleholidaypark.co.nz
- holidayparks.co.nz
- allseasonsrotorua.co.nz
- helisika.co.nz
Australian examples include ballinaglamping.com.au, missionbeachhideaway.com.au, cedunaforeshorecaravanpark.com.au and breamlea.com.au.
The use of RMS Cloud does not mean these individual properties have been compromised or that their guests have been targeted. Their inclusion here identifies examples of the platform’s regional footprint, not confirmed victims.
The incident nevertheless highlights the risks associated with centralised booking platforms and the sensitive customer information processed by accommodation providers. If booking data is exposed or accessible to an unauthorised party, it can be used to create highly targeted scams that exploit the trust guests place in their accommodation provider.
Advice for affected customers
RMS has advised recipients of suspicious communications not to click links, to delete the messages and not to forward them to others.
Anyone who has already interacted with a suspicious message should take the following precautions:
- Clicked a link: Run an antivirus scan and change passwords if credentials may have been exposed.
- Provided payment details: Contact your bank or financial institution immediately and follow its advice.
- Unsure whether a request is genuine: Contact the accommodation provider using a previously verified phone number or website, rather than replying to the message or using its links.
Accommodation providers should also consider notifying guests through trusted channels, warning staff about the campaign and verifying unexpected requests involving payment information or integration credentials.
Investigation ongoing
RMS has acknowledged the concern this incident is causing customers and their guests and says it is working with accommodation partners to communicate appropriate precautions.
The key outstanding questions are how the booking details became available to the scammers, how many customers have been affected, and whether any unauthorised access to systems or data has occurred.
Until further technical details are released, the incident should be treated as an active phishing threat associated with booking information, rather than definitive proof of a particular breach mechanism.
ThreatIntel.co.nz will continue to monitor developments, including any confirmation of impacts on New Zealand accommodation providers.
