The Kempinski group, based in Munich, confirms a guest data breach followed by fake payment requests - La Revue des Hôtels

In a notice published on its website dated November 12, 2026, the Munich-based luxury hotel group confirmed that an unauthorized person accessed guests' booking information through a compromised login credential belonging to one of its third-party technology partners. The data was subsequently used to contact guests, posing as Kempinski hotels, in an attempt to request fraudulent payments.

The group stated that no payment card data was involved, as these are not stored in the compromised system. However, Kempinski acknowledged it cannot rule out the possibility that passport or visa numbers were among the exposed information. The hotel chain has revoked the compromised credential and closed the access route, launching an investigation with the support of an independent cybersecurity specialist.

Data exposure details

According to the investigation, the exposed data is limited to three categories: guests' names, their booking details (including stay dates, hotel names, and itinerary numbers), and their contact information (mobile phone numbers and email addresses). The notice does not specify the channel used for the fake payment requests, the name of the affected technology partner, or the number of guests contacted.

We sincerely apologize for causing concern and are doing everything we can to support impacted guests

Guest response measures

Kempinski has directed guests to contact the concerned hotels directly using details published on its official website. For security questions or to verify the authenticity of received messages, the group provides a contact form at the bottom of its notice. The hotel chain has also notified relevant data protection authorities as required, though it did not specify which authorities were informed.

Several questions remain unanswered, including the exact number of affected guests, the list of hotels involved, the period covered by the exposed bookings, when the access was discovered, and the name of the technology partner. The notice is currently only available in English.

Company background

Founded in 1897, Kempinski describes itself as the oldest luxury hotel company in the world. Its properties include the Hotel Adlon Kempinski in Berlin, the Kempinski in Cancún, Mexico, and the Augustine in Prague, which it acquired and plans to relaunch in early 2027. The company's headquarters are located at Maximilianstraße 17 in Munich, Germany.