Campers planning summer getaways are being urged to watch for suspicious messages after a data breach at third-party provider Bookeasy potentially exposed personal information of national parks visitors across multiple states. Queensland Parks and Wildlife Service, South Australia’s parks service and the Shire of Carnarvon said customer information may have been accessed, while Parks Victoria reported suspicious messages to customers. The South Australian service said there was no evidence credit card details were accessed, and Bookeasy said it had not identified any access to credit card details.
Queensland Parks and Wildlife Service (QPWS) confirmed on Thursday that Bookeasy, the third-party provider managing its national parks booking system, had suffered a data breach. The issue extends beyond Queensland, with national parks booking services in Victoria and South Australia also affected, and a Western Australian visitor centre operator separately confirming a security incident involving the same provider.
Bookeasy said it first detected unauthorised activity within its platform in early November and immediately began investigating, engaging cyber security experts. In a statement, the company said some customers' personal and booking information had been or may have been accessed, but that it had not identified any access to credit card details.
The breach has raised concerns about the security of personal information held by the shared booking platform, with customers' names, contact details and booking information potentially accessed. National parks and camping grounds are popular destinations over the Christmas holiday period, raising concerns about the potential exposure of personal details of people planning trips.
QPWS said it was working closely with Bookeasy to investigate and establish what information may have been accessed and how many people could be affected. It stressed there was currently no indication customers' financial information had been compromised, as payments are processed separately through a secure system.
Parks Victoria acknowledged the broader issue, confirming it had received reports of suspicious WhatsApp messages being sent to customers about their bookings. As a precaution, it has temporarily suspended all new campsite bookings while investigating. Existing bookings remain valid, but customers are temporarily unable to make changes or modifications.
National Parks and Wildlife Service South Australia told customers Bookeasy had detected unauthorised activity and engaged cyber security experts to investigate. The service said some customer information may have been accessed, but at this stage there was no evidence that credit card details were accessed.
In Western Australia, the Shire of Carnarvon issued a security alert confirming a recent incident involving Bookeasy, which manages its visitor bookings. The Shire said customer contact details and booking information may have been accessed and also warned about suspicious WhatsApp messages circulating in relation to bookings.
The departments urged anyone who had used the booking system to be alert to unexpected emails, text messages, WhatsApp messages or phone calls claiming to be from the department. Customers were warned not to respond to requests to confirm or provide personal information, passwords or payment details, and to delete suspicious communications immediately. Anyone who clicked on a suspicious link has been advised to run an antivirus scan and change their passwords.
As of November 12, there was no public confirmation that NSW National Parks and Wildlife Service customers had been affected.
Analysis
Why This Matters
- The breach affects thousands of campers during the peak holiday season, when national parks bookings are at their highest
- Personal information including names, addresses and phone numbers has been exposed, increasing the risk of targeted phishing scams and identity fraud
- The incident highlights the vulnerability of government services reliant on third-party providers, following other recent data breaches involving Queensland government contractors
Background
Bookeasy is a third-party provider that manages booking systems for national parks and visitor services in several Australian states. Based in Southport on the Gold Coast, the company says it has more than 20 years of experience in tourism technology and processes more than 20 million bookings each year. The breach follows a separate incident involving another Queensland government contractor, Instructure, which in May saw more than five years of student and staff data obtained by cybercriminals from the state Education Department's QLearn online learning management system.
Key Perspectives
Queensland Parks and Wildlife Service: said it believed some personal information including contact details may have been accessed, but at this stage did not think financial information was stolen. It apologised for any concern and said it would provide further information to affected customers as more was known.
Bookeasy: said it had taken immediate containment action after detecting unauthorised activity in early November, engaged cyber security experts and was working with external specialists. It said some customers' personal and booking information had been or may have been accessed, but that it had not identified any access to credit card details.
Parks Victoria: confirmed it was aware of suspicious WhatsApp messages being sent to customers and had temporarily suspended all new campsite bookings while investigations continued. It said existing bookings remained valid but changes or modifications could not be made during the investigation.
National Parks and Wildlife Service South Australia: told customers that some information including names, contact details and booking information may have been accessed, but there was no evidence credit card details were accessed.
Shire of Carnarvon (WA): confirmed a security incident involving Bookeasy and warned about suspicious WhatsApp messages, saying customer contact details and booking information may have been accessed.
What to Watch
- Whether affected customers report phishing attempts or identity fraud in coming weeks
- Whether Bookeasy provides a full count of affected customers and a timeline for resolution
- Whether any further states or territories confirm their customers were affected
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedPersonal data was stolen in a hack of National Parks booking systems used by Queensland, Victoria and South Australia.Latest business news: “Hackers have stolen personal user information from Queensland, Victoria and South Australia's National Parks booking systems.”
- SupportedQueensland, Victoria and South Australia were affected.Latest business news: “The National Parks booking system for Queensland, Victoria and South Australia has been hacked.”
- SupportedQueensland’s department said it did not believe financial information was compromised.Latest business news: “The spokesperson said "at this stage" they did not believe customers' financial information was accessed, as payments are processed through a separate system.”
- SupportedSouth Australia’s parks service said some customer information, including names and contact details, may have been accessed.Latest business news: “it has been identified that some customer information, including names, contact details, and booking information, may have been accessed.”
- SupportedThe Queensland department told 612 ABC Brisbane that third-party provider Bookeasy had been hacked.Latest business news: “The Queensland Department of Environment, Tourism, Science, and Innovation told 612 ABC Brisbane that the third-party provider Bookeasy had been hacked.”
- SupportedThe Queensland department spokesperson gave the quoted warning about unexpected messages or calls asking for personal information.Latest business news: “"If you receive an unexpected email, text message or phone call claiming to be from the department and asking you to confirm or provide personal information, do not respond, click on any links, or provide any personal information," the spokesperson said.”
- SupportedParks Victoria was aware of “suspicious Whatsapp messages” being sent to customers.Latest business news: “A Parks Victoria spokesperson said they were aware of "suspicious Whatsapp messages" being sent to their customers.”
- SupportedParks Victoria had temporarily suspended all new campsite bookings while investigations continued.Latest business news: “The spokesperson said they had temporarily suspended all new campsite bookings while investigations continued.”
- SupportedThe Parks Victoria spokesperson said, “We are working urgently with Bookeasy to understand the issue and proactively communicating with our customers who may be impacted.”Latest business news: “"We are working urgently with Bookeasy to understand the issue and proactively communicating with our customers who may be impacted," the spokesperson said.”
- SupportedExisting bookings had not been cancelled and remained valid.Latest business news: “"Existing bookings have not been cancelled and remain valid.”
- SupportedChanges or modifications to existing bookings could not be made during the investigation.Latest business news: “"While we investigate, we are also temporarily unable to make changes or modifications to existing bookings."”
- SupportedThe South Australian email said there was no evidence that credit card details were accessed.Latest business news: “"At this stage, there is no evidence that credit card details were accessed."”