Medialog cyberattack exposes data of 1,500 French hotels

French software provider Medialog has suffered a major cyberattack, resulting in the theft of approximately 135 GB of data. The breach affects the clients of roughly 1,500 hotels, including many independent establishments and small groups, particularly in Paris.

The intrusion began on September 27, 2026, via a critical vulnerability in a web service that had existed since late June. After a period of reconnaissance, attackers performed a massive data extraction on the night of October 4–5. The stolen information includes traveler identities, dates and places of birth, nationalities, postal and email addresses, phone numbers, and specific stay details such as room numbers and deposit amounts.

Medialog has stated that credit card numbers and identity document numbers were not compromised. However, the stolen data is already being used in sophisticated phishing campaigns. Fraudsters are contacting hotel guests via WhatsApp and email, using authentic reservation details to direct victims to fake websites designed to steal banking information.

Medialog has blocked the intrusion and is notifying affected establishments, which are advised to alert the CNIL and their customers.