The Department of the Environment, Tourism, Science and Innovation is investigating a data breach involving Bookeasy, the third-party provider that manages the Queensland National Parks Booking Service, and is contacting affected customers directly. The department says that at this stage it does not believe customers' financial information has been accessed, as payments are processed separately through a secure system.
Bookeasy processes camping and vehicle access permits for the booking system, storing personal emails, addresses and phone numbers, the ABC reported on Thursday (12 November). The department told 612 ABC Brisbane the provider had been hacked. "Hackers have stolen personal user information from Queensland, Victoria and South Australia's National Parks booking systems," the ABC reported.
In a status update last updated on Wednesday (11 November), Bookeasy said it recently detected unauthorised activity within its platform and took immediate containment action, including engaging cyber experts. "For some of our partners, it appears that some personal and booking information of their customers has been or may have been accessed," the company said. It said that, based on the status of its ongoing investigation, it has not identified any access to credit card details.
Bookeasy said it first detected the issue in early November and is confident its containment efforts have resolved the issue, with an external third-party expert validating that work. "The nature of these incidents may mean that gaining certainty over what was accessed is not always possible," it said. The company said that based on its current investigations there is no connection between the recent RMS security incident and this Bookeasy incident.
Scam Messages Warning
The department is asking park users to be alert to unexpected emails, text messages, WhatsApp messages or phone calls claiming to be from the department or relating to a national parks booking. Its advice is to report the communication to [email protected] before taking any action, not to click on links or open attachments, and to contact your bank immediately if payment details have been provided.
"If you receive an unexpected email, text message or phone call claiming to be from the department and asking you to confirm or provide personal information, do not respond, click on any links, or provide any personal information," a department spokesperson told the ABC. "We take the privacy and security of your information extremely seriously and will provide further information to affected customers as soon as we know more."
Bookeasy said there has been an increase in scam attempts targeting the travel industry, and that it is aware of some customers receiving phishing messages via WhatsApp that may relate to the incident.
Victoria Suspends New Bookings
Parks Victoria said on Wednesday it had temporarily suspended all new campsite bookings as a precaution while it investigates, after reports of suspicious WhatsApp messages being sent to some customers. Existing bookings have not been cancelled and remain valid, it said, although changes to existing bookings are temporarily unavailable. Parks Victoria does not communicate with customers via WhatsApp.
In an email to users, National Parks and Wildlife Service South Australia said "some customer information, including names, contact details, and booking information, may have been accessed" and that "at this stage, there is no evidence that credit card details were accessed", the ABC reported.