I'll update this story if the chain shares more details.

◢What happened

Iberostar, the hotel chain based in Mallorca, has sent a notice to its customers. According to Tourinews¹, which published an excerpt on November 6, the incident may have allowed access to first and last names, email addresses, stay dates and the hotel booked.

The company says it has found no access to ID numbers or to bank or card details. But the incident already has consequences: the chain itself has identified fake emails sent to some customers demanding a payment on the pretext of confirming their booking.

◢What we know and what we don't

We know which data may have been exposed and that it is already being used for scams. We don't know how many customers are affected, when the access happened or through which system. According to MuySeguridad², the chain also hasn't said whether an outside vendor is involved or whether it has notified Spain's data protection authority, and the outlet couldn't find the notice published on the company's website.

◢Why this scam works so well

The email doesn't arrive with a generic "dear customer". It has your name, your hotel and your dates, details that in principle only you and whoever handled the booking know. That's why it looks legitimate. According to INCIBE-CERT³, it usually links to a fake payment page imitating the hotel or the agency that asks for your full card details, sometimes with a 24-hour deadline to rush you.

◢What to do if you've booked with Iberostar

1. ▹Don't pay anything through a link sent by email, text or WhatsApp, even if it has your real details.
2. ▹If you're asked to confirm or pay for your booking again, go to the official website yourself or call the hotel using a number you look up, not the one in the message.
3. ▹If you've already entered your card, call your bank to block it and report it to the police.
4. ▹If you're in Spain and unsure about a message, INCIBE's free cybersecurity helpline, 017, is open every day.
5. ▹Expect these emails to keep coming for weeks. How to spot a phishing email covers the signs worth checking.

◢If you run a hotel or rental

INCIBE-CERT³ recommends changing the passwords for booking platforms and email from a trusted device, closing open sessions, turning on two-factor authentication and reviewing users, message templates and the bank account payments go to. If personal data is affected, assess the risk and, where required, notify the data protection authority within 72 hours and tell your customers.

The underlying problem is the same as in other recent attacks: the risk isn't only in your own systems but in those of the vendors that handle your data. I covered it in the Crédit Mutuel Arkéa cyberattack and in attacks don't come in through the server. If you want your team to spot these emails before a customer pays, that's part of what I cover in my cybersecurity and AI training.