D-EDGE and Misterbooking hit by data breaches affecting hotel guests

Two French providers of hotel software, the D-EDGE booking engine and Misterbooking, a property management tool published by Septeo Hospitality, were hit by separate security incidents in mid-October 2026. Guest data from hotel reservations was exposed in both cases.

The alert surfaced through an email that a hotel near Paris sent to its customers on 29 October 2026. The message described two incidents that were "distinct and independent of each other" and affected two of its technical providers. Neither D-EDGE nor Septeo had responded to requests for comment at the time of writing.

D-EDGE: a configuration error

According to the hotel's email, a misconfiguration at D-EDGE let unauthorised parties access booking data on 20 and 21 October. The company only informed the hotel on 23 October. The exposed data includes stay dates, booking reference, the price of the stay and the hotel name, plus the email address and phone number for some reservations. D-EDGE says its cloud commerce tools are used by more than 17,000 hotels in over 150 countries, so the potential scope is wide, though the number of affected properties has not been disclosed.

Misterbooking: an intrusion

The Misterbooking case is an intrusion. Septeo Hospitality detected on 19 October that a third party had gained illegitimate access to one of the software's servers. Access was cut the same morning, but the attacker was able to extract part of the data. The hotel industry body GHR, in a note to members dated 23 October, spoke of a "significant share" of stored data being taken.

The data is more sensitive here: identity and contact details of guests and their companions, booking information and documents attached to customer files. The scale remains unknown. Misterbooking is used by 1,800 establishments, and Septeo Hospitality has 4,000 equipped hotels in France, Spain and other European countries.

Phishing risk

No full bank card data is believed to be involved, but the leaks make highly credible scams likely. Earlier this month, after the breach at another French hotel software vendor, Medialog, hotel guests were targeted on WhatsApp and by email with their real booking details.

A message quoting your booking number, dates and price is therefore no longer proof of authenticity. If it asks you to confirm a card, pay a deposit or click a link to avoid a cancellation, do not respond. Call the hotel on the number listed on its official website or on your original confirmation.