TUI acknowledges data breach, scale remains unknown
Customers received phishing messages containing possibly genuine hotel and travel details.
Follow-up to: TUI investigates leak after targeted WhatsApp fraud Sunday, 11 October 2026, 10:52
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
TUI has confirmed that it is investigating a data breach after customers received WhatsApp messages containing a striking amount of correct travel information. It is not yet known how many customers were affected or whether the details mentioned actually came from the breach.
The new development is that TUI has confirmed the existence of a data breach to VTM Nieuws. According to the travel company, an international team is investigating the cause and the scale. TUI has not yet clarified which systems were involved, the period during which data was accessible or the number of potentially affected customers.
According to reports, the messages reported by customers contained full names, hotels and travel dates. Some recipients received a WhatsApp request to click on a link for a quick check-in or to arrange a payment. The combination of a real destination and a real departure date made the messages more credible than a generic phishing attempt.
The fact that the messages contained travel information does not in itself prove that the data came directly from a TUI system. TUI is also investigating the origin of the information. The organisation cannot yet say whether the reported data relates to this breach or became available through another party in the booking chain.
TUI says it has warned customers not to open suspicious messages or make payments. The Belgian website states that TUI does not ask customers to pay for a booked trip or flight via an account number. To check a booking, the company refers customers to its own website, app or official contact centre.
The possible consequences for Dutch travellers have not yet been established. Tweakers writes that it is unclear whether customers from the Netherlands or other countries were affected alongside Belgian customers. It is also not known exactly which categories of data were taken; the reported names, hotels and travel dates come from customer reports and do not yet constitute a complete inventory.
The incident is relevant to the travel industry because booking information can be used directly to win people’s trust. A fraudulent message mentioning a hotel and departure date may persuade customers to hand over additional information or money. The investigation therefore concerns not only how many records may have been leaked, but also how the information could be combined and used.
One story, several perspectives
What is established
- TUI is investigating a data breach.
- Customers reported phishing messages containing travel information.
- The scale and source of the breach have not yet been established.
Left
Arguments Travel organisations collect highly detailed information about customers’ behaviour and whereabouts and must therefore provide maximum transparency and strong security.
Values Privacy, consumer protection and accountability.
Consequences More oversight, faster notifications and potentially tougher penalties for companies that fail to protect data adequately.
Centre
Arguments TUI must first carefully establish which systems and customers were affected, while communicating clearly about risks and practical protection measures.
Values Carefulness, proportionality and reliable incident response.
Consequences A factual approach prevents panic and helps customers protect themselves while the investigation produces useful answers.
Right
Arguments Companies must be held accountable, but customers must also handle links, payments and booking information with care.
Values Personal responsibility, security and clear liability.
Consequences The emphasis is on better security as well as tougher enforcement against fraudsters who misuse leaked data.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
Reports confirm the existence of a data breach and TUI’s warning. The text clearly distinguishes between reported phishing data and proven access to TUI systems.
- confirmed TUI has confirmed a data breach and is investigating its scale. — Tweakers quotes a TUI spokesperson and describes the ongoing investigation. source
- confirmed Customers reported messages containing names, hotels and travel dates. — Tweakers and the summarised VTM reporting mention these details. source
- confirmed TUI advises customers not to open suspicious links or make payments. — This appears in the reporting and in TUI’s own phishing warning. source
- confirmed The origin of the data and the number of affected customers are unknown. — According to Tweakers, TUI had not yet clarified the scale or source. source
Editor's note
TUI has confirmed the data breach and is warning customers. The scale, source of the data and possible consequences for Dutch customers remain unknown; the travel details mentioned are based on customer reports.Sources
The story so far
- Sunday, 11 October 2026, 10:52 TUI investigates leak after targeted WhatsApp fraud
- Sunday, 11 October 2026, 22:27 TUI acknowledges data breach, scale remains unknown (this article)
More on this in Dutch media
- Tweakers — „tui datalek”
- AD — „tui datalek”
- RTL Nieuws — „tui datalek”