Points Capital

If you have a Kempinski stay booked, or had one recently, treat any email, text or WhatsApp asking you to “confirm” the booking or make a prepayment as a scam until proven otherwise. Kempinski told guests on Wednesday evening, November 11, that someone misused a third-party technical provider’s access key and got at guest data, and that fraudsters are already using it.

What Kempinski says happened

According to the notice Kempinski emailed guests, which Berlin’s Tagesspiegel reviewed, an unauthorized person misused an access key belonging to a third-party technical provider. The data that may have gone out: names, phone numbers, email addresses and reservation details. Payment card data was not taken, per the company. Kempinski says it blocked the access once it learned of the incident, hired an independent cybersecurity firm to investigate, and notified the responsible data protection authorities (Tagesspiegel).

The uncomfortable part is what Kempinski cannot rule out. LoyaltyLobby, which published the guest notice, quotes it as saying the company “cannot confirm, nor can we exclude” that sensitive data such as passport or visa numbers was affected (LoyaltyLobby). Hotels in many countries are required to collect passport details at check-in, so that caveat matters for anyone who stayed at a Kempinski outside the U.S.

German wire service dpa reports that the Hotel Adlon Kempinski in Berlin is among the affected properties, which a spokesperson confirmed (dpa via Volksstimme). Kempinski has not published a count of affected guests or a full list of hotels as of this writing. It is a Geneva-based group that runs luxury hotels across Europe, the Middle East, Africa and Asia, so assume any Kempinski reservation could be in scope until the company says otherwise.

The scam that follows a breach like this

This is the part that costs travelers money. The stolen data set is exactly what a scammer needs to sound legitimate: your name, your real confirmation number, your real hotel and your real dates. Kempinski warned guests that people posing as hotel staff are already reaching out by email, SMS and WhatsApp (Tagesspiegel), and dpa reports the messages impersonate Kempinski representatives and demand payment (dpa via Lippische Landes-Zeitung).

We’ve seen this playbook before with Booking.com-connected hotels: a message arrives referencing your actual reservation, says your card “failed verification” or that a prepayment is now required to hold the room, and links to a payment page that looks like the hotel’s or the booking site’s. Because every detail checks out, people pay. A WhatsApp message from a foreign number quoting your confirmation number is not proof the sender is the hotel; it is proof the sender has your data.

What to do if you’re affected

1. Don’t click, don’t reply. Kempinski’s own advice to guests is not to click links in these messages or respond to them (Tagesspiegel). Hotels do not collect prepayments over WhatsApp.
2. Verify through a channel you control. If you want to confirm anything about your stay, call the hotel using the number on kempinski.com, or log into the account you booked through. Never use a phone number or link from the suspicious message.
3. If you already paid, move fast. dpa’s guidance, echoing German consumer advocates: block the card immediately, notify your bank, and file a police report (dpa via Volksstimme). In the U.S., call the number on the back of your card and dispute the charge as fraud; the sooner you report it, the stronger your position.
4. If you gave a passport at check-in, watch for it. Kempinski has not confirmed passport or visa numbers leaked, but it has not ruled it out either. Passport numbers alone rarely enable identity theft the way a Social Security number does, but they are used in targeted phishing. Be skeptical of any “visa problem” or “immigration” message that quotes your number.
5. Change your password if you reused it. Nothing in Kempinski’s notice says passwords were taken, but if your Kempinski Discovery or booking account shares a password with your email, this is the moment to fix that.
6. Keep the notice. If you were emailed by Kempinski, save it. If a fraudulent charge or identity issue surfaces later, that notice is your evidence the breach happened and that you were in it.

Our take

The breach itself is bad; the follow-on fraud is what will actually hurt people, and that’s where you have control. The data that leaked lets a scammer pass every “does this sound real?” test, so the only reliable defense is procedural: hotels get paid at check-in or through the booking channel you used, not through a link someone sends you. If a message about a reservation ever asks for money, stop, open a new browser window, and go to the hotel yourself.

Credit to Kempinski for the notice being plain about what it doesn’t know. “We cannot confirm, nor can we exclude” is an honest sentence that a lot of breached companies would have lawyered into nothing. We’ll update this post if Kempinski publishes a guest count, a hotel list or a finding on the passport question.

Sources

• Der Tagesspiegel: Luxushotelkette Kempinski warnt vor Betrugsnachrichten (reports the contents of Kempinski’s guest notice)
• LoyaltyLobby: Kempinski Data Breach – Guests Targeted In Phishing Scams (publishes the guest email)
• dpa via Volksstimme: Hackerangriff auf Kempinski
• dpa via Lippische Landes-Zeitung
• AHGZ (German hotel trade press): Hacker haben Gästedaten von Kempinski erbeutet

Facts as of November 13, 2026. Kempinski had not published a public statement on its own site at the time of writing; details above come from its emailed guest notice as reported by the outlets linked.