Bookeasy breach: national parks booking customers’ names, contact details and booking information may have been exposed
Parks agencies in Queensland, Victoria and South Australia say a breach at booking provider Bookeasy may have exposed names, contact details and booking information.
What happened
Bookeasy, the booking platform that runs national parks reservations for the Queensland Parks and Wildlife Service and is also used by parks agencies in Victoria and South Australia and a visitor operator in Western Australia, detected unauthorised activity in early November 2026. The company says it immediately began containment, engaged external cyber specialists and started notifying its partner agencies. Queensland Parks and Wildlife Service emailed its customers on Wednesday, November 11, and on Thursday, November 12 the Queensland, Victorian and South Australian agencies and the Western Australian operator told customers that the platform breach may have exposed their information. Parks Victoria has temporarily suspended its external bookings system altogether: no new bookings can be made, and existing bookings cannot be changed or cancelled, while Bookeasy works with an outside expert to validate that its containment has resolved the issue. Parks Victoria says bookings will reopen only when it is satisfied the system can keep customer data secure, and the forensic investigation into the full scope is still running. This report is labelled POTENTIAL EXPOSURE because the agencies’ own wording is that the information “may have been” accessed, and whether any customer data was actually taken has not yet been confirmed.
Who is affected
The people affected are customers who booked through the Bookeasy-run systems — national parks visitors in Queensland, Victoria and South Australia, and customers of the Western Australian visitor operator that uses the platform. The information the agencies say may have been exposed is names, contact details and booking information. No agency has published a count of affected customers, and Bookeasy processes bookings at a large scale — its own site says more than 20 million bookings a year across its tourism platform — but that is platform volume, not an affected count, and this report does not present it as one. Two points are stated clearly by the agencies: payments are processed through separate systems, and the investigation has not identified any access to credit card details. Existing reservations remain valid; in Victoria they simply cannot be changed or cancelled while the system is suspended.
How serious
The concrete risk is targeted phishing built on real bookings. A name and contact details joined to a genuine parks reservation — which park, which dates, which campsite — is exactly what a scammer needs to pose as a parks agency with a believable story: a “problem” with your booking, a refund that needs your card, a rebooking link ahead of the summer peak. That risk is not theoretical here: Parks Victoria’s own customer notice is headed “Suspicious WhatsApp messages linked to booking system issue,” and the agencies are already urging customers to ignore unexpected emails, texts and WhatsApp messages about their bookings. What this data does not do on its own is take money: no card details have been identified as accessed, and payment systems sit outside Bookeasy. The danger arrives as a convincing message, not as a charge — which is why the booking details themselves, ordinary as they sound, are the part worth protecting.
What to do now
If you have a parks booking in Queensland, Victoria, South Australia or through the affected Western Australian operator, treat unexpected emails, texts and WhatsApp messages about it as untrusted, even when they quote your real name, park or dates: do not click links in them, and do not give personal or payment information to anyone who contacts you about a booking. If you need to check or discuss a reservation, go to the official parks agency website yourself, by typing the address or using the agency’s own app — never through a link supplied in a message. In Victoria, expect disruption rather than danger from the suspension itself: existing bookings remain valid but cannot be changed or cancelled until the system reopens, so plan around that instead of accepting a stranger’s offer to “fix” your booking for a fee. If a message about your booking asks for card details or a code, it is a scam on the agencies’ own account of how they operate — report it to the agency through its official contact page and delete it.
Sources: Parks Victoria, “Suspicious WhatsApp messages linked to booking system issue,” updated November 12, 2026 · Particle, “Shared booking platform breach may have exposed national parks visitors’ details,” November 12, 2026 (summarising ABC reporting and the Queensland, Victoria and South Australia agency notices)