IT security incident
Public Notice for Affected Parties Who Cannot Be Contacted Individually
Public Notice for Affected Parties Who Cannot Be Contacted Individually
In September 2026, in connection with the use of our hotel software, a data protection incident occurred in which attackers were able to gain unauthorised access to reservation data and customer profiles. As we do not have valid contact details for all data subjects, the Bahn Sozialwerk Foundation (BSW) informs you below, in accordance with Article 34 GDPR, about the nature and scope of the incident, the data affected, possible risks, and the measures taken.
1. What happened?
In the period from 07/09/2026 to 18/09/2026, external attackers were able to access reservation data and customer profiles via certain API endpoints of the Protel Web Services without authentication. According to the current status of the IT forensic investigation, export functions of the Protel Web Services API were used to gain Access to
835.517 reservations and
197.528 customer profiles.
The customer profiles include in particular:
197,528 data records with name or company name,
101,373 data records with email address,
191,436 data records with telephone number,
175,311 data records with address,
145,904 data records with date of birth.
In addition, 17 reservation data records were identified which contained a total of 9 items of credit card information. Credit card data were therefore not the main focus of the attack but were affected only in very isolated cases. Persons whose credit card information is contained in the aforementioned reservation data records will be separately informed individually.
Subsequently, individual guests were contacted via WhatsApp, SMS or email with fraudulent messages in which specific hotel bookings and travel periods were mentioned and they were requested to enter credit card details via manipulated links.
2. Which data are affected or potentially affected??
The incident may particularly affect or potentially affect the following categories of data:
Master data (name/company name, address, date of birth),
Contact data (email address, telephone number),
Booking information (e.g. hotel, travel period, booking number, accompanying persons).
By contrast, credit card information has only been identified in exceptional cases in the stolen reservation data records. For the vast majority of data subjects, it can be assumed that no such data were affected in the context of the present data exfiltration.
3. What risks exist?
The incident gives rise in particular to the following risks:
Financial risks: fraudulent payment requests and attempts to obtain credit card or other payment details via manipulated links.
Risk of loss of control over personal data: use of contact and booking data for targeted fraudulent approaches (“social engineering”).
Security-related risks: to the extent that attackers have access to home addresses and periods of absence, this could theoretically be misused to plan burglary attempts during the absence. The Foundation currently has no specific indications of such cases; however, the risk cannot be completely ruled out.
4. What measures has the Foundation taken?
The Bahn Sozialwerk Foundation (BSW) has taken, among other things, the following
measures:
Notification of the data protection incident to the competent data protection supervisory authority in accordance with Article 33 GDPR,
Informing the data subjects about the incident and the recommended precautionary measures,
Technical immediate measures in the IT environment (including blocking of the exposed port, restricting applications to the internal Wi-Fi, hardening the infrastructure),
Engaging a specialised IT forensics service provider to clarify the attack vector and the scope of the data exfiltration, and
Ongoing coordination with the software manufacturer and review of possible contractual and legal steps.
The forensic investigations are ongoing. The Foundation will update this information page as soon as new, security-relevant findings emerge.
5. What can you do yourself?
We particularly recommend that you:
Exercise caution with messages (SMS, WhatsApp, emails) in which reference is made to your hotel booking and you are requested to enter payment or credit card details via links. Do not open any links if you have doubts about their authenticity.
Only enter payment or credit card details via channels that are known and trustworthy to you (e.g. directly at the hotel or via well-known booking platforms).
Check your account movements and credit card statements carefully and contact your bank or credit card provider immediately if you notice any irregularities.
Furthermore, always take appropriate precautions with regard to longer absences (e.g. securing your home, informing trustworthy persons), even though there are currently no specific indications of burglary attempts in connection with the incident.
6. Contact
If you have any questions regarding the incident, you can contact the following office at any time:
Bahn Sozialwerk Foundation (BSW)
Data Protection Team
Email: Datenschutz@Stiftungsfamilie.de
In addition, a hotline has been set up for you at +49 (0)69-809076-444.
It is available Monday through Friday from 9:00 a.m. to 4:00 p.m.
The hotline will go live on Monday, October 19, 2026.
The Bahn Sozialwerk Foundation (BSW) takes the incident very seriously and will reassess the findings once the forensic investigations have been completed. Should this give rise to further or amended security-relevant information, this information page will be updated accordingly.
