Data breach: Hotel and accommodation, Switzerland 2026
Criminals stole booking data from a component of the hotel’s booking system and wrote to guests via WhatsApp.
- Incident · 09.2026 · Lenzerheide GR, Switzerland
- Evidence: one media report
- Data breach
- Phishing
- Attack via a supplier
As of
What happened
They promised a voucher for 250 francs if the guests entered personal data and credit card information. The hotel warned around 10'000 guests; according to «Blick», there is a connection with an Austrian IT service provider for the hotel industry.
- Affected
- Hotel Schweizerhof Lenzerheide
- Industry
- Hotel and accommodation
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- Booking data of guests; around 10'000 guests warned
- Bankruptcy
- no
- Entry point
- Data exfiltration from a component of the booking system (third-party system)
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
The more third-party systems are attached to a booking, the more important it is to have an overview of who holds which guest data.
Sources
- Hotel in Lenzerheide warnt Gäste vor Phishing (opens in a new window) Netzwoche (gestützt auf Blick) · 08.09.2026
«Es ist schwierig, das Leck zu orten, da bei einer Reservation verschiedene Drittsysteme involviert sind»