Wexford hotel warns of phishing attacks after third-party data breach

A Wexford hotel has sent out a warning to their customers…

Hotel Curracloe in Wexford has issued a warning regarding phishing attacks following a data breach. It comes following a recent security incident involving the hotel’s booking system provider, Guest Diary.

“First and foremost, we want to reassure you that your reservation with Hotel Curracloe remains safe and fully confirmed. Guest Diary – the system used to manage bookings, experienced a security breach in late March. This resulted in limited guest contact details being accessed through their platform. Importantly, no encrypted payment or credit card information was accessed, and all payment data remains secure. The data breach occurred to Guest Diary systems and NOT Hotel Curracloe systems,” the hotel stated.

Following this incident, there have been a number of phishing attempts targeting guests. These messages are typically sent via WhatsApp or email and may refer to your booking details, such as your dates of stay. They can appear to come from trusted sources like Guest Diary, Hotel Curracloe, Booking.com, or Expedia, and often ask you to make a payment to “secure” your reservation. In many cases, they also include links to websites that look legitimate but are actually fraudulent.

GuestDiary has confirmed that the attackers initially gained access via an infected computer at a separate, unrelated hotel business. From there, they intercepted a two-factor authentication code and installed malware, which allowed them to exploit a vulnerability in the GuestDiary platform and extract guest reservation details.

Hotel Curracloe has warned and advised that they will never request payment via WhatsApp or send payment links in this manner. To stay safe, guests are strongly advised not to click on any links in unexpected messages, not to respond to or engage with the sender, and never to share personal or payment information through unsolicited messages.

Speaking to Wexford Weekly regarding the incident, Curracloe Hotel manager JP Hanrahan said:

“Hotel Curracloe’s systems remain secure and unaffected. The breach occurred on GuestDiary’s systems. The moment we became aware of what had happened, my priority was making sure our guests knew. Affected guests had already been contacted by the provider — but I wasn’t prepared to leave it at that.”

“Not everyone sees every email, so we went the extra mile to get this information out across email and social media ourselves. As a family-run hotel, our guests are not just customers — they trust us, and that trust means we will always go above and beyond to protect them.”

“We know that scams and phishing attempts are increasing, and the sophistication of these attacks is increasing with them. We want every one of our guests to be as aware as possible, so they are armed with the knowledge to avoid these criminals. If anyone is ever in doubt about a message, a link or a request for payment, please just reach out to us directly — we are here.”

The third party platform, Guest Diary, is actively managing this situation, working to shut down fraudulent websites and prevent further activity while Hotel Curraclose said that they are also continuing to monitor developments closely.