Oceania Hotels
ModerateConfirmedRetail
French hotel group Oceania Hotels (Océania, Escale Océania, Nomad Hotels brands) confirmed that an unauthorized third party accessed booking data after a provider hosting its online reservation engine was compromised. The exposed data covers stays booked for August 2026 through July 2027: name, email, phone number, booking reference, property identifier, stay dates and rates. The group states no banking data was involved, and it notified the French data protection authority (CNIL) and filed a complaint.
The exposed details (name, stay dates, booking amount and reference) allow highly credible phishing messages by SMS or WhatsApp impersonating the hotel.
- Disclosed on
- September 20, 2026
- Sector
- Retail
- Country
- France
- Cause
- Third-party provider
Exposed data
- Full name
- Email address
- Phone number
- Customer ID
- Order history
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact