Personal Data Breach Notification

Personal Data Breach Notification Concerning the IdoBooking Reservation System

Kraków, 6 November 2026

Dear Guests,

Following information received from the operator of the IdoBooking reservation system regarding a security incident that may have resulted in the disclosure of your personal data, we would like to provide you with details of the incident, its potential consequences, and the security measures taken in response.

We use the IdoBooking platform to manage our guests' reservations and stays. Its operator, IdoBooking sp. z o.o., based in Szczecin, Poland, processes personal data on our behalf as a data processor within the meaning of Article 28 of the General Data Protection Regulation (GDPR).

1. Description of the Incident

On 1–2 November 2026, a security incident occurred within the IT systems of the IdoBooking operator. According to the information provided, an unauthorised individual obtained authentication credentials for an internal technical service of the platform and subsequently used them to create an additional account with administrator privileges in certain customer administration panels, including ours.

The individual also designated an email address under their control as a recipient of automated system notifications concerning reservations.

The unauthorised access lasted from 1 November 2026 at 00:45 until 2 November 2026 at 12:38. The operator detected the incident on 2 November at 09:00 and initiated measures to block the unauthorised access.

According to the operator's findings to date, there was no modification of the application code, installation of malicious software, or direct access to the system's databases.

2. Scope of Personal Data Affected by the Breach

According to the information provided by IdoBooking, notifications sent to the unauthorised email address contained information relating to your reservations.

Depending on the type of notification, the data may have included:

  • Guest's first and last name;

  • Telephone number and email address;

  • Reservation number and booking source;

  • Dates of stay, property name, and reserved accommodation unit;

  • Number of guests and additional services booked;

  • Total reservation amount and outstanding balance;

  • Information confirming receipt of a payment;

  • Preferred language of communication.

Not all of the above categories of data were necessarily included in the notifications relating to your reservation.

The operator confirmed that the notifications did not contain payment card numbers, bank account numbers, or account passwords.

3. Potential Consequences of the Breach

The most likely consequence of this incident is the risk of fraudulent attempts using the disclosed information, particularly through emails, SMS messages, or telephone calls from individuals impersonating our accommodation provider, the reservation system operator, or payment service providers.

Unauthorised individuals may use genuine details of your reservation, such as your dates of stay, property name, or outstanding payment amount, to make fraudulent messages appear credible. Such messages may request additional payments, reservation confirmations, or payment card details.

There is also a risk that contact information may be used to send unsolicited communications or to attempt to obtain further personal information through fraudulent means.

4. Measures Taken in Response to the Incident

According to the information provided by IdoBooking, immediately after detecting the incident, the operator began blocking unauthorised access and subsequently:

  • Revoked and replaced the authentication credentials used during the incident;

  • Removed unauthorised user accounts and terminated their active sessions;

  • Removed unauthorised email addresses from the system notification recipient lists;

  • Analysed system logs and identified the reservations covered by the notifications;

  • Implemented and announced additional security measures relating to administrator account management and the protection of technical services.

The operator confirmed that no further notifications were sent to unauthorised email addresses after the security vulnerability had been blocked.

On our part, we have reviewed user accounts, changed administrator passwords, verified notification email addresses, conducted a risk assessment, and analysed the data affected by the incident.

In cooperation with the IdoBooking operator, we have identified 107 individuals whose personal data confidentiality was confirmed to have been compromised.

Nevertheless, we recommend that all our customers follow the precautionary measures outlined below, even if they were not directly affected by the incident.

5. Recommended Precautionary Measures

In light of this situation, we strongly recommend exercising particular caution when receiving messages or telephone calls concerning your reservations.

In particular, we advise you to:

  • Verify any requests for additional payments or changes to payment methods directly with our accommodation provider using previously known, official contact channels;

  • Avoid opening suspicious links or attachments received in unexpected messages;

  • Never disclose payment card numbers, CVV/CVC codes, BLIK codes, passwords, or authentication codes in response to messages or telephone calls;

  • Exercise caution when dealing with individuals who refer to specific details of your reservation, as knowledge of such information does not confirm the sender's identity.

If you receive a suspicious message concerning a payment or reservation, please contact us before taking any action.

Suspicious SMS messages may also be forwarded to CERT Polska at 8080 (a Polish service for reporting suspicious text messages).

6. Contact and Additional Information

If you have any questions regarding the personal data breach or suspect that your personal data may have been misused, please contact:

Wiesław Włodarczyk RTApart

Tax Identification Number (NIP): 6811091175

Address: ul. Raciborsko 397, 32-020 Wieliczka, Poland

Contact person: Wiesław Włodarczyk

Email: ww@rtapart.pl

Telephone: +48 501 015 299

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych – UODO) at www.uodo.gov.pl.

We sincerely apologise for this incident and any inconvenience it may have caused. We treat the security of our guests' personal data as a top priority.

Yours sincerely,

Wiesław Włodarczyk RTApart