BWH Hotels 2026 Customer Data Breach

BWH Hotels, the parent company of WorldHotels and Best Western Hotels & Resorts, disclosed a data breach affecting guests with reservations at one of its properties. The breach occurred over a six-month period, compromising personal information of individuals. The disclosure was made public in June 2026, prompting an urgent alert for guests to watch for fraudulent messages.

The attack involved unauthorized access to the hotel chain's reservation system, allowing threat actors to exfiltrate personal details of guests. The specific initial access vector and exploitation techniques have not been detailed, but the prolonged access suggests a credential compromise or vulnerability exploitation. The compromised data includes names, contact details, and reservation information, which could be used for targeted phishing campaigns.

No further post-incident details have been provided, including regulatory involvement, litigation, or remediation milestones. The company has advised guests to remain vigilant against suspicious communications.