Fraudsters are already sending fake payment requests with the stolen data. Kempinski Hotels has confirmed a data security incident in which an unauthorised party got limited access to guest reservation data, and guests are now receiving fake payment requests by email, SMS and WhatsApp quoting genuine booking confirmation numbers and stay dates. The messages look real because the details are real. Kempinski notified affected guests by email on 11 November 2026, Der Tagesspiegel reported, and the fraud began almost immediately.
Guests of Berlin’s Hotel Adlon Kempinski are among those affected, a Kempinski spokeswoman confirmed to the dpa wire. Kempinski, founded in 1897, is Europe’s oldest luxury hotel group, operating 82 hotels and residences in 34 countries, per Kempinski’s 2024 ESG report. No victim count has been disclosed by Kempinski or any source, so the scale is unknown. What is known is that the stolen data is already being weaponised.
How do you spot a fake Kempinski payment request?
Kempinski says its hotels will never ask you to confirm card details through a link, or to pay through a link sent by WhatsApp. Any message that does either is fake, whatever booking details it quotes. Treat the confirmation number and stay dates as stolen data, not proof the sender is Kempinski.
- Stop before tapping any payment link in a message about your stay.
- Open a fresh tab and go to the hotel’s own website or your booking confirmation directly.
- Check whether the hotel has asked you for payment, using the contact details on its site.
- Forward the suspicious message to Kempinski for verification at breach-notification2026@kempinski.com.
- Do not reply to the message.
The fraud works because the details are correct. The messages quote genuine booking confirmation numbers and stay dates, and typically ask for a payment, or for card details to be confirmed through a payment link, according to the guest email published by LoyaltyLobby. Kempinski’s website adds that its hotels do not request payment or bank transfers via WhatsApp. Existing reservations remain confirmed, Kempinski said, so a message claiming your booking will be cancelled unless you pay now is inventing a threat.
What was taken, and what was not
The data that may have been accessed, per Kempinski’s investigation so far, is guest names, email addresses and phone numbers, plus reservation details: hotel, stay dates and booking confirmation number. That is the data identified so far, and the reason the fake requests are so convincing. A scammer with your name, number, hotel, dates and confirmation number can write a message that reads like it came from the front desk.
No payment card information was involved, because card details are not stored in the affected system, Kempinski said in its guest email. That is the one clear piece of good news: the fraudsters do not have your card number from this incident. What they are doing is using the booking details to trick you into handing card details over yourself, through a payment link.
One question remains unresolved. The company said it cannot confirm, nor can it exclude, that sensitive personal information such as passport or visa numbers may have been affected. That is not a confirmation that passport numbers were exposed, and it must not be read as one. It is an open question for the investigation. The access window is also undisclosed.
How the breach happened
An unauthorised party misused an access credential used by one of Kempinski’s external technology partners, gaining limited access to certain guest reservation data, Kempinski confirmed to German hospitality publication Hotel vor9. The partner has not been named. The credential has been revoked and the access route closed. Kempinski said it began an investigation with an independent cybersecurity specialist, notified the relevant data protection authorities, and is working with the partner on protection and monitoring of partner credentials.
The shape is familiar: a supplier credential opened a limited window into reservation data. What makes it different is the speed of the follow-on fraud. Guests were notified on 11 November, and the fake payment requests were already circulating, quoting the stolen details. The fraud was already underway by the time Kempinski notified guests on 11 November, which is why the warning reads as urgent rather than precautionary.
Four days from email to headlines
TechReview analysis: the disclosure moved in a clear four-day arc. Kempinski emailed affected guests on 11 November. On 12 November, LoyaltyLobby published the guest email, and Hotel vor9 confirmed the incident with Kempinski at 16:06 UTC. On 13 November, the dpa wire carried the story. On 14 November, French trade press picked it up, with La Tribune de l’Hôtellerie publishing its account. Trade press first, wire second.
Kempinski is another hotel-sector booking-data story, after the Wyndham app data exposure, which we covered on 12 November. The Wyndham incident is separate, and no connection between the two has been reported. The difference is what happened next. Wyndham said it had no evidence of unauthorised access to its systems. Kempinski has confirmed access, and the stolen data is already being used in live payment scams. A separate, unverified claim about Expedia circulated the same week, alleging tens of millions of profiles stolen; it is unconfirmed and not connected to Kempinski. Kempinski is the confirmed case where stolen booking data is already being weaponised, while the victim count is still undisclosed. That is why this article leads on the fraud risk, not on a number it does not have.
What to do if you already paid
No confirmed case of a guest actually losing money to the fake payment requests has surfaced in any source checked. Receipt of the fraudulent messages is confirmed; completed fraud payments are not. But if you did pay, or entered card details through a link, Kempinski’s advice is specific.
- Have the card blocked with your bank at once.
- Dispute the charge with your bank, and explain it followed a fraudulent payment request.
- File a police report.
- Keep all evidence of the exchange, including the original message and any payment confirmation.
Kempinski offers a written attestation that the charge was neither authorised nor processed by the hotel, to support a dispute with your bank. If you are unsure whether a message you received is genuine, verify it through the dedicated address Kempinski set up for this incident, breach-notification2026@kempinski.com, rather than by replying to the message itself. La Tribune de l’Hôtellerie reported the verification address and the advice for guests who paid, drawing on the guest email.
What to watch next
Three questions will decide how this story ends. The first is whether passport or visa numbers were affected, which Kempinski has neither confirmed nor excluded. The second is the guest count, which no source has disclosed, and the access window, which Kempinski has not given. The third is whether the third-party technology partner is named. Whether other hotel groups using the same partner are in scope is a question for the investigation, and the incident could then become a supplier story.
Two more things are worth watching. A regulator statement, from the German or Berlin data protection authority, would show whether the incident is being treated as a formal breach case, and any confirmed guest payment-loss case would turn an attempted scam into a completed one. Until then, the facts are: a partner credential was misused, reservation data was accessed, no card data was in the affected system, and fraudsters are already sending fake payment requests that quote real booking details. If a message about your Kempinski stay asks you to pay through a link, it is fake, whatever details it gets right.
