LekkeSlaap: Accommodation Booking Platform Suffers Cyber Attack

• Accommodation booking platform LekkeSlaap detected unauthorized activity on its calendar-syncing system.
• Names, surnames, email addresses, phone numbers, and booking reference numbers of some guests were accessed.
• No payment information, identity numbers, or passwords were compromised in the incident.
• LekkeSlaap warns customers to be cautious of phishing attempts and to only make payments through its official platform.
• This incident is separate from a recent data breach reported by NightsBridge, another South African accommodation technology provider.

Crucially, LekkeSlaap has assured customers that sensitive financial details, such as payment card information, identity numbers, or user passwords, were not compromised during the event.

The prominent local accommodation booking platform, LekkeSlaap, recently alerted its extensive customer base to a significant cyber incident. The company detected unauthorized activity targeting its calendar-syncing system, leading to the compromise of specific guest booking information. Following the discovery, the Cape Town-based platform, which is operated by Tripco (acquired by a consortium of investors in October 2026) and has been a key player in the Southern African travel market since its founding in 2013, confirmed that it has successfully contained the breach and taken measures to secure its systems.

The data accessed by the unauthorized party includes guests' full names, surnames, email addresses, telephone numbers, and unique booking reference numbers. It is crucial for customers to note that LekkeSlaap has explicitly stated that more sensitive personal identifiers, such as payment card details, identity numbers, or user passwords, were not compromised during this security event. Furthermore, the company has provided reassurance that all existing reservations made through its platform remain confirmed and have not been impacted by the incident, ensuring that travel plans can proceed as scheduled.

In the wake of the data exposure, LekkeSlaap has issued a comprehensive advisory to its users, emphasizing the heightened risk of fraudulent activities. The primary concern is that malicious actors could exploit the accessed booking details to orchestrate sophisticated phishing attempts. These scams might involve criminals impersonating either LekkeSlaap directly or individual accommodation hosts, sending deceptive communications through various channels, including unexpected emails, SMS messages, WhatsApp, or even telephone calls.

Customers are strongly urged to exercise extreme vigilance and caution when encountering any unsolicited messages that request payments or seek to verify personal details, even if these communications appear to contain accurate booking references. LekkeSlaap has provided clear guidelines: users should never click on suspicious links, nor should they share sensitive security credentials such as passwords, one-time PINs, or payment card information with anyone. The platform also reinforced that all legitimate payments for bookings should exclusively be processed through its official website, and it will never instruct customers to transfer funds to a bank account different from those explicitly listed on its secure online portal.

This security incident at LekkeSlaap is not an isolated event within the South African travel technology sector. It follows closely on the heels of a separate data breach reported by NightsBridge, another South African accommodation technology provider, which had also alerted its clients to unauthorized access to booking information earlier in the current week. LekkeSlaap has, however, explicitly clarified that its own breach is entirely distinct from the NightsBridge incident, with no indications suggesting any operational or causal connection between the two events. These occurrences collectively highlight the ongoing and evolving cybersecurity challenges confronting online service providers across the travel and hospitality industry.

LekkeSlaap itself is a significant online booking platform, headquartered in Cape Town and operated by Tripco. Since its establishment in 2013, it has grown to list a wide array of accommodation options across the entirety of Southern Africa. Its extensive offerings include diverse choices such as holiday homes, guest houses, bed-and-breakfast establishments, hotels, resorts, and even game lodges, catering to a broad spectrum of travelers. For any customers requiring assistance or seeking further clarification regarding their existing bookings or the details of the security incident, LekkeSlaap's dedicated bookings team is available to provide support. They can be reached directly by telephone at 021 201 8901 or through email at bookings@lekkeslaap.co.za.

Source: Based on company statements and industry reports.