BWH Hotels (Best Western) Discloses 6-Month Reservation System Breach
BWH Hotels, parent of Best Western, WorldHotels and SureStays, notified guests that hackers maintained access to its reservation web application from October 2025 to April 2026. The company confirmed the unauthorized access and began sending breach notifications. No payment data was stored or accessed in the affected system.
- names
- email addresses
- telephone numbers
- home addresses
- reservation details
BWH Hotels, the parent company of Best Western, WorldHotels, and SureStays, has disclosed that hackers maintained unauthorized access to its reservation web application for six months, exposing the personal information of tens of thousands of guests.
Public reporting indicates the breach lasted from October 2025 through April 2026. The compromised system contained names, email addresses, telephone numbers, home addresses, and reservation details. BWH Hotels confirmed no payment card data was stored or accessed in the affected environment. The company has begun sending direct notifications to impacted guests, and the incident is now under investigation.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary Warden™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15.4B+ leaked records in 15 seconds — then show you the $19 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →