Skip to main content
beyond stay
← Back to home

Booking security update

Last updated: 22 October 2026 · Europe/Athens

What happened

In its official update dated 21 October 2026, Hosthub, our reservation management provider, confirmed a personal data breach. According to Hosthub, an unauthorised third party exploited a vulnerability in its application server infrastructure and obtained reservation data from its database. We have received reports of fraudulent WhatsApp messages using genuine booking details to impersonate accommodation or booking representatives.

Information involved

According to Hosthub, the data involved may include the guest’s name, telephone number, check-in and check-out dates, reservation amount and property name. Accurate booking details do not make a message genuine. These details may be used in convincing phishing messages seeking card information, security codes or bank approval, with a risk of financial fraud.

Which reservations may be affected

Hosthub identifies potentially affected reservations held in its system as those with an arrival date on or after 16 October 2026 that were created on or before 18 October 2026. We are working with the provider to confirm the specific reservations and the full scope affecting our guests. This date range is not a confirmation that every reservation within it was accessed.

Your reservation

No additional payment or card verification is required through these fraudulent links. Ignoring these messages will not cancel your reservation. If you are unsure about a payment request, contact us through your existing booking conversation or the contact details on this website before taking action.

How to protect yourself

Do not open suspicious links. Do not enter card details, share passwords or one-time codes, or approve bank notifications to verify your reservation through WhatsApp links. Keep screenshots and the sender’s number, then report and block the sender in WhatsApp. Do not forward sensitive payment details to us.

If you entered details or approved a request

Contact your bank immediately using its official app or the number on your card. Explain what happened and follow its instructions about blocking or replacing your card and disputing any unauthorised transaction. If you entered a password, change it on the genuine service and anywhere else you reused it. Let us know what happened without sending passwords, card numbers or codes.

Containment and continued caution

Hosthub reports that it disabled the vulnerable functionality and ended the attacker’s access on 20 October 2026 at 12:00, Europe/Athens. Data already obtained may still be used in fraudulent messages for weeks or months, including before your arrival. Please remain cautious even if a previously reported fraudulent website is no longer available.

What we are doing

We have issued guest warnings and are working with Hosthub to establish the full impact and follow up on protective measures. We will update this page as further verified information becomes available. We are sorry for the concern and inconvenience.

Contact Beyond Stay

Data controller: CLARITY GROUP ΟΕ / Beyond Stay

booking@beyondstay.gr

Include your booking reference and describe the suspicious message. Please do not send card details or security codes.

Beyond Stay newsletter

Local inspiration and selected offers.

Occasional destination guides, stay ideas and offers. No unnecessary emails.

We use essential cookies for the platform to function. Analytics and marketing cookies require your consent.

With marketing consent, the email of a completed paid booking may be sent to Google Ads as a SHA-256 hash to measure advertising results. The hash remains personal data. It is not sent to Google Analytics. You can withdraw consent in Cookie settings.

With separate Meta marketing consent, Meta receives page and property views, searches, checkout starts and confirmed paid bookings with gross stay value, plus IP address and browser/cookie identifiers. No email, phone or advanced matching is sent to Meta. You can reject or withdraw this separately in Cookie settings.