TUI Belgium is investigating a suspected data breach after travellers received fraudulent WhatsApp messages containing accurate booking details, including their names, hotels and travel dates. The messages, sent from foreign numbers, directed customers to links or requested information to verify reservations, sometimes warning that bookings could be cancelled. TUI has not disclosed the number of potentially affected customers or confirmed that its systems were breached.
An international team is working to identify how the information was obtained, what data may have been exposed and the scope of the incident. The activity currently appears limited to Belgian customers; TUI has no indication that Dutch travellers have been affected.
The company warned customers about an increase in fraudulent WhatsApp messages earlier this month and contacted them with instructions not to open suspicious messages, click links, disclose personal or banking information, or make payments. TUI does not request payments through WhatsApp and advises travellers to check bookings through its official channels or a travel agency.
Reports have linked the messages to numbers associated with countries including Brazil, Portugal and the United Kingdom. The apparent accuracy of the itinerary details has raised concerns about payment fraud, identity theft and the disclosure of travellers’ absence from home, but the source of the information and its direct connection to TUI remain unverified.