Threat actors gained unauthorized access to a web application used by BWH Hotels to store guest reservation data, maintaining access for approximately six months. The compromised data includes personally identifiable information such as names, contact details, and reservation specifics, but excludes payment or financial data. The breach was discovered on April 22, 2026, and the affected system was promptly taken offline. An investigation involving external security experts is ongoing. There is no indication of known exploits or a specific vulnerability disclosed. The incident raises concerns about potential phishing or scam attempts using the stolen data.

The breach exposed personally identifiable information of an unspecified number of BWH Hotels guests, including names, email addresses, phone numbers, and reservation details. Financial and payment information was not compromised. The exposure of this data may facilitate phishing attacks or scams targeting affected individuals. There is no evidence of further exploitation or additional data compromise reported. The operational impact includes the temporary removal of the affected web application from service.

BWH Hotels has taken the compromised web application offline and is conducting an investigation with external security experts. No patch or fix details are provided, and the vendor advisory does not specify remediation steps beyond incident response actions. Organizations should monitor communications from BWH Hotels for updates and advise affected individuals to be vigilant against phishing attempts. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.