Wakacje.pl suffers cyberattack exposing customer passport data

The Polish travel aggregator Wakacje.pl, owned by the Wirtualna Polska holding, has suffered a cyberattack. On September 29, unauthorized individuals gained access to several employee email accounts and the company’s customer service system.

As a result, sensitive personal information belonging to some customers may have been compromised. The leaked data includes names, residential addresses, email addresses, phone numbers, dates of birth, and passport data. It remains unclear whether the breach included passport numbers alone or full scans of the documents.

The company has clarified that the stolen information does not allow access to the Customer Panel and does not involve the portal’s payment systems. However, Wakacje.pl is warning customers to be vigilant against highly credible phishing attempts. Criminals may use the stolen details to impersonate hotels or travel organizers, requesting urgent payments or credit card updates for existing reservations.

Experts and the company suggest that affected individuals consider reporting their passports as lost or stolen via the mObywatel application to prevent identity theft.