LekkeSlaap Cyberattack Exposes Guest Booking Details in South Africa

South African accommodation platform LekkeSlaap has warned guests that an intruder accessed some booking information through its calendar-syncing system. The company says it has contained the incident, but the exposed details could make fraudulent messages look unusually convincing to travellers with existing reservations.

According to a customer notice described by ITWeb on 6 November, the information includes some guests’ names, email addresses, phone numbers and booking reference numbers. LekkeSlaap says passwords, identity numbers and payment card details were not accessed. It also says existing bookings remain valid. The number of people affected has not been disclosed.

The important distinction is between a stolen card number and information that could help a criminal persuade someone to pay. A message that names a real property, references a genuine booking and arrives close to a planned trip may feel more credible than a generic phishing email. The company’s warning therefore focuses on impersonation, not evidence that customers’ payment accounts were directly compromised.

LekkeSlaap says guests should be wary of unexpected email, SMS, WhatsApp or phone requests to confirm details or make a payment, even if the message includes a correct booking reference. It advises customers to make payments through its platform and says it will not ask for money to be sent to a different bank account.

Anyone receiving an urgent payment request can pause and open the service directly, rather than using a link in the message. If a host appears to have changed bank details, contact LekkeSlaap or the property using a number already listed in the booking account. Do not share a one-time code or password with a caller claiming to fix a reservation. These steps do not undo the exposure, but they make it harder to convert booking data into a successful scam.

The intrusion reportedly involved the system used to synchronise calendars. LekkeSlaap has not publicly provided a technical account of how the attacker gained access, how long that access lasted or whether a supplier was involved. It would be premature to describe this as a platform-wide breach or to infer that all guests were affected.

ITWeb also reported that accommodation technology company NightsBridge notified clients of a separate incident involving booking information earlier in the same week. There is no evidence that the two cases are connected. Their proximity does, however, underline why travel platforms need to consider not only direct financial theft but also the abuse of reservation data in follow-up fraud.

TechBooky previously covered a separate Booking.com exposure affecting South African users. The circumstances differ, and the incidents should not be merged into one attack. What they share is the problem facing travellers after booking information leaves its intended system. Even limited personal details can give a scammer the context needed to appear legitimate.

For now, LekkeSlaap’s confirmed message is that it detected and contained unauthorised activity, affected bookings remain in place, and guests should verify any new request for payment. Further clarity on the scale and cause of the breach will depend on the company’s investigation.