Australian travellers are being warned their personal information may have been exposed following a cybersecurity breach involving Australian booking management software provider RMS Cloud, ABC News reported on 27 October 2026.

According to the ABC, RMS said it is investigating reports of phishing messages sent by WhatsApp, SMS and email that "reference genuine booking information" and request payment details; its website said: "Our teams are actively investigating the activity and taking steps to contain it, protect customer information and support affected customers and integration partners" and "No payment card information has been exposed from RMS."

The ABC says major holiday park operators including Reflections, BIG4 and G'day Parks are understood to have been affected, and that RMS provides cloud-based property management and booking systems to more than 6,000 hotels, holiday parks and serviced apartments worldwide, according to its website.

A BIG4 spokeswoman told the ABC that a breach of a third-party platform used by some parks in its network, as well as other accommodation providers and groups, had resulted in some guests receiving fraudulent messages asking for credit card or payment details.

On its own booking-safety page, BIG4 says RMS, a booking system used by a third of BIG4 holiday parks, has experienced a security incident involving unauthorised access to guest contact and booking information, that the incident is not specific to BIG4 and has also affected holiday park and hotel accommodation providers outside its network, and that credit card and payment details were not accessed through this incident. Reflections Holidays (NSW) texted guests that RMS had made it aware of phishing emails claiming booking payments had failed, and Summerstar Tourist Parks, which runs caravan parks across Western Australia, warned guests on social media, according to the ABC.