Two Australian Brands Hit by Vendor Breaches in One Week: What RMS Cloud and Who Gives A Crap Customers Need to Know

Two well-known Australian names reported data breaches in the same week, and in both cases the weak point was a supplier. Holiday booking software firm RMS Cloud found unauthorised access in its systems on 26 October 2026, and guests of Australian holiday parks and hotels then received scam messages quoting their real booking details. Days later, toilet paper brand Who Gives A Crap told customers a marketing software provider it uses had also been accessed without authorisation. Here is what happened and what to do if you are affected.

What happened at RMS Cloud

RMS Cloud is an Australian cloud booking and property management system used by hotels, holiday parks, serviced apartments and campgrounds. The company says it serves more than 6,000 properties in over 70 countries. On Monday 26 October 2026, RMS says it identified unauthorised access to what it called a limited part of its environment.

According to RMS, the data involved was a subset of guest reservation information: guest contact details and booking information. RMS says card and payment details were not involved, a point repeated by the ABC, Cyber Daily and Insurance Business. No count of affected guests has been published.

The brands reported as affected include BIG4, Reflections, G'day Parks and Summerstar, plus Federal Group, ALH Hotels and Discovery Parks properties, according to the ABC. None of the parks or hotels was breached directly. Their guests were targeted because of a system their vendor runs.

RMS says it notified the Australian Cyber Security Centre, the information commissioner and the National Office of Cyber Security on 30 October. On 2 November the company said the activity had been contained, while it keeps assessing the scope. Its chief executive, Adam Seskis, apologised, according to the ABC.

How the scam messages worked

Guests began reporting the scam messages on the night of 26 October. They arrived by WhatsApp, text and email, and they quoted real booking details. The ABC described one email carrying a genuine booking number, room type and dates. It said the guest's card was blocked and the booking would be cancelled unless they clicked a link to update their card details.

That detail is what makes this kind of scam work. A message with your real booking number looks like it came from the business you booked with, so it is easy to trust. RMS has been clear about this. It says the messages are not being sent by RMS, and it will never ask guests for card details or payment through WhatsApp.

RMS moved quickly once it found the problem. It sent customers a guest email template, worked to take down the scam websites and contact channels, issued new credentials to integration partners, and brought in forensic, cyber and legal specialists.

The second breach: Who Gives A Crap

Who Gives A Crap, the Australian toilet paper brand, told customers there had been unauthorised access at a US-based marketing software provider it uses, which it has not named. By the company's account, the access began on 30 October 2026, was found on 31 October, and the systems were secured on 1 November. The provider told Who Gives A Crap on 6 November, and the company began emailing customers on 7 November, according to the ABC and Cyber Daily. This is a separate incident from RMS Cloud.

The company says the details involved were names, email addresses, phone numbers, mailing addresses and the total amount spent, for customers in Australia, the UK and the US. It says payment details, order details and passwords were not included, and it does not yet know whether the information was copied or downloaded. It has disconnected the provider and changed access credentials. The ABC reported the company has no evidence of misuse so far.

What the national numbers say

The Office of the Australian Information Commissioner's latest Notifiable Data Breaches figures, released on 26 October 2026 and covering January to June 2026, show 667 breach notifications, up slightly from 662 in the previous six months. Breaches affecting more than one million people rose to 11 from 4, and three breaches affected between 500,000 and one million people, up from none in the previous period. Malicious or criminal attacks were the leading cause overall, and more than half of breaches were identified within 10 days.

What to do if you are affected

If you booked a stay with a park or hotel that uses RMS Cloud, treat any message about your booking with care. Do not click a link in a message that asks you to update card details. Go to the park or hotel's own website or call the number on your original booking confirmation, and check whether anything about your booking has actually changed. A message quoting your real booking number is not necessarily genuine: the scammers have that detail because of the breach.

If you are a Who Gives A Crap customer, watch for unexpected emails, texts or calls claiming to be from the company, and verify them through the company's own website or customer service channels before you click anything. The details involved are enough for a convincing phishing message, so stay alert for a while.

If you paid a scammer, call your bank straight away. You can also report scams to Scamwatch, and report cybercrime through ReportCyber at cyber.gov.au. If you run a small business, this week is a good time to ask your booking or marketing vendor how it would tell you about a breach, how fast, and who notifies your customers.

Frequently Asked Questions

Was my credit card affected by the RMS Cloud breach?

According to RMS, card and payment details were not involved in the breach. The data involved was guest contact information and reservation details. Attackers used the booking details to send messages asking guests to update card details through fake links.

How do I know if a booking message is a scam?

A genuine booking business will not ask you to update card details through a link in a surprise message. If a message says your card is blocked or your booking will be cancelled, do not click the link. Contact the park or hotel through the number or website on your original booking confirmation.

What data did the Who Gives A Crap breach expose?

The company says names, email addresses, phone numbers, mailing addresses and the total amount spent were involved, for customers in Australia, the UK and the US. Payment details, order details and passwords were not included. It does not yet know whether the information was copied or downloaded.