Latest / Tech Talks With Kinsoft / RMS Cloud - A Booking Platform Breach, Scam Messages with Real Reservation Details, and the Accommodation Providers Left to Warn Their Own Guests

Transcript

RMS Cloud - A Booking Platform Breach, Scam Messages with Real Reservation Details, and the Accommodation Providers Left to Warn Their Own Guests · Tech Talks With Kinsoft

• 0:00
  Imagine you've spent, you know, months planning
• 0:02
  this big school holiday trip for your family.
• 0:05
  The bags are basically packed in your mind. The
• 0:09
  kids are finally excited about something that
• 0:11
  isn't a screen. Yeah, a rare moment. Right, exactly.
• 0:14
  And then just completely out of nowhere, you
• 0:16
  get a WhatsApp message on your phone. And it
• 0:19
  says your payment failed and your booking is
• 0:22
  about to be canceled entirely unless you act
• 0:24
  right this second. Which is terrifying. It is.
• 0:28
  And the crazy part is it has your name, the correct
• 0:31
  dates of your stay, and the exact name of the
• 0:34
  hotel you booked. I mean, your heart just drops
• 0:38
  into your stomach and you instinctively just,
• 0:40
  you reach for your wallet. Because it is a brilliantly
• 0:44
  engineered panic button. I mean, that reaction,
• 0:47
  that instant bypass of all our logical defenses
• 0:50
  is the exact psychological mechanism we are dissecting
• 0:54
  today. We're looking at a master class in modern
• 0:57
  manipulation. And it's all fueled by this deeply
• 1:00
  hidden digital supply chain. Okay, let's unpack
• 1:04
  this. We are on a mission today to explore a
• 1:06
  massive, highly targeted data breach, and it
• 1:10
  involves an Australian cloud provider called
• 1:12
  RMS Cloud. We're synthesizing a big stack of
• 1:15
  reporting from ABC News, Cyber Daily, the Standard
• 1:19
  of Warrnambool, and Insurance Business Australia.
• 1:22
  Some really great on -the -ground reporting there.
• 1:25
  Definitely. And our goal here is to figure out
• 1:27
  how a backend software company that, let's face
• 1:30
  it, most of us have never even heard of, can
• 1:32
  suddenly make you the direct target of a hyper
• 1:34
  -personalized scam. And, you know, what that
• 1:37
  actually reveals about how fragile our digital
• 1:39
  infrastructure really is. Yeah. And the timeline
• 1:42
  here is just critical for understanding the sheer
• 1:44
  velocity of these attacks. I mean, the inciting
• 1:47
  incidents really started bubbling up around Monday,
• 1:49
  the 26th of October, 2026. Right. Almost simultaneously,
• 1:53
  guests of all these various Australian accommodation
• 1:56
  providers were just bombarded with these frantic
• 1:59
  messages. And the thing is, these weren't arriving
• 2:01
  in some cluttered email inbox where you kind
• 2:03
  of just expect to see spam. No, not at all. These
• 2:06
  were coming straight through WhatsApp and direct
• 2:07
  text messages. And the premise was so highly
• 2:10
  specific, a claim that the payment on their upcoming
• 2:13
  booking had failed. And it came with a link demanding
• 2:16
  immediate credit card updates if they wanted
• 2:18
  to save the reservation. Right. And we all know
• 2:20
  standard phishing usually relies on those spray
• 2:23
  and pray tactics, like the classic dear customer
• 2:26
  emails with terrible grammar and vague threats.
• 2:30
  Yeah, the ones you spot a mile away. Exactly.
• 2:33
  But this bypassed our normal mental spam filters
• 2:35
  because it was a highly targeted spear phishing
• 2:38
  campaign. They were leveraging precise, validated
• 2:41
  supply chain data. They essentially weaponized
• 2:44
  context. And the panic this caused on the ground
• 2:47
  was just immediate. Looking at the reporting
• 2:49
  from the ABC, they actually featured Cherie Midson.
• 2:53
  She manages a holiday park in East Gifflin, Victoria.
• 2:56
  Yeah, I saw that. And she reported that these
• 2:58
  hyper -accurate messages started hitting her
• 3:01
  guests on a Sunday night. By Monday morning,
• 3:04
  her phone was just ringing constantly with guests
• 3:07
  who were utterly panicked. She had to immediately
• 3:09
  loop in scam watch. Which is standard procedure.
• 3:11
  Right. And she spoke about just being terrified
• 3:14
  for her business's reputation. Because, I mean,
• 3:17
  when you run a regional holiday park, thrust
• 3:19
  is basically your only currency. Which is entirely
• 3:22
  understandable. When the threat involves losing
• 3:25
  a fully paid booking during the absolute peak
• 3:27
  busy season of school holidays, I mean, our cognitive
• 3:31
  processing fundamentally changes. People just
• 3:33
  rush. Exactly. They rush. They don't scrutinize
• 3:35
  the URL and the text message. They just want
• 3:37
  to save their family vacation. And to put the
• 3:40
  scale of this tactic into perspective, the ScamWatch
• 3:43
  data cited in our sources notes over 13 ,000
• 3:46
  phishing reports in just the first three months
• 3:48
  of 2026 alone. Wow. 13 ,000. It's like getting
• 3:53
  a ransom note for a pet, but the kidnapper knows
• 3:56
  the pet's name, their favorite toy, and exactly
• 3:59
  what time you feed them. That is a great way
• 4:01
  to put it. It totally disarms your natural skepticism
• 4:04
  because the attacker just has this inside knowledge.
• 4:07
  But, I mean, that raises the really obvious question.
• 4:10
  If the scammers had this validated, hyper -specific
• 4:13
  information, the names, the dates, the specific
• 4:16
  caravan parks, where did they actually acquire
• 4:19
  it? Because they obviously didn't get it by,
• 4:21
  like, breaking into a physical filing cabinet
• 4:23
  at Cherie Midson's park in East Gippsland. No,
• 4:26
  definitely not. The local parks were really just
• 4:29
  the visible endpoint here. The data was actually
• 4:32
  extracted from the invisible middleman sitting
• 4:34
  way behind all of these businesses. And that
• 4:37
  brings us to RMS Cloud. For anyone outside the
• 4:40
  hospitality industry, this company is largely
• 4:43
  invisible. But they are an Australian provider
• 4:45
  of cloud -based property management and booking
• 4:48
  software. And according to their own materials,
• 4:51
  they serve more than 6 ,000 hotels, holiday parks,
• 4:54
  and service departments worldwide. And to really
• 4:57
  understand the impact here, we need to look at
• 4:59
  what a property management system or PMS actually
• 5:02
  does. It's essentially the central nervous system
• 5:05
  of a hotel or a holiday park. It handles everything,
• 5:08
  right? Exactly. It handles the logistics, the
• 5:10
  availability calendars, housekeeping schedules,
• 5:12
  and crucially, the central customer database.
• 5:15
  Properties rely on platforms like RMS because
• 5:17
  building custom, secure infrastructure from scratch
• 5:20
  is just, you know, it's prohibitively expensive
• 5:23
  for a regional caravan park. And because RMS
• 5:26
  is that central nervous system, a single vulnerability
• 5:28
  creates this massive blast radius. I mean, the
• 5:32
  reports from October 27th and 29th show this
• 5:34
  just staggering list of affected operators. We
• 5:37
  are talking about Big Four, Reflections Holidays
• 5:40
  in New South Wales, Summer Star Tourist Parks
• 5:43
  in Western Australia. It was everywhere. Yeah.
• 5:45
  And G'day Parks was reported as understood to
• 5:48
  be affected, too, though the ABC didn't have
• 5:51
  a direct statement from them at the very beginning.
• 5:54
  The scale really crossed state lines and property
• 5:57
  types almost instantly. It wasn't just caravan
• 6:00
  parks either. The ABC noted on October 29th that
• 6:03
  Tasmania's federal group, which runs the really
• 6:06
  prominent Rest Point Hotel in Hobart, was caught
• 6:09
  up in this. Same with ALH hotels and discovery
• 6:12
  parks. So the attackers hit major urban hotels
• 6:15
  and pubs right alongside these regional tourist
• 6:18
  spots, all through this one central hub. which
• 6:21
  really just highlights the immense concentration
• 6:23
  of risk in cloud computing today. Let's actually
• 6:27
  look at the exact data that was compromised,
• 6:28
  though, because the nature of the stolen data
• 6:31
  dictates the entire architecture of the attack.
• 6:34
  Right. The Warrnambal City Council provides a
• 6:37
  really perfect case study here. They operate
• 6:39
  the Surfside and Shipwreck Bay caravan parks,
• 6:41
  and they had to urgently contact about 6 ,000
• 6:44
  customers on October 29th. The six caravan parks
• 6:48
  run by the Moines Shire. which also use RMS,
• 6:51
  face the exact same issue. Yeah. And according
• 6:54
  to the Warrnambool City Council director, the
• 6:56
  data access was highly specific, but technically
• 6:59
  limited. It included customer names, contact
• 7:02
  info like phone numbers and emails, and those
• 7:04
  really crucial booking dates. But here is the
• 7:08
  critical piece of the puzzle. RMS stated emphatically
• 7:11
  that no payment card information had been exposed
• 7:14
  from RMS. Right. That limitation is... the key
• 7:17
  to this entire deep dive. The attackers infiltrated
• 7:20
  this massive database, but they didn't get the
• 7:22
  prize. They didn't get the credit card numbers.
• 7:24
  So the stolen data was essentially just the raw
• 7:27
  material. They couldn't just drain the bank account
• 7:30
  silently in the background. So they had to build
• 7:33
  a trap to force the consumer to hand over the
• 7:36
  credit card details themselves. Exactly. The
• 7:38
  text messages weren't the hack. The text messages
• 7:41
  were the result of the hack. Precisely. Now,
• 7:44
  regarding RMS's actual response, they did acknowledge
• 7:46
  that the phishing messages referenced genuine
• 7:49
  booking information, and they engaged cyber and
• 7:52
  forensic specialists to try to contain the activity.
• 7:54
  By October 27th, they had provided template emails
• 7:58
  for their operators to warn guests, and they
• 8:00
  were actively pursuing the takedown of the scam
• 8:02
  websites. And the CEDO issued a formal apology,
• 8:06
  right? He did, yeah. But there is a very specific
• 8:09
  technical detail in the Cyber Daily reporting
• 8:11
  that we really need to scrutinize. On October
• 8:14
  28th, RMS began issuing new credentials to its
• 8:17
  integration partners. Okay, so if RMS is resetting
• 8:20
  integration credentials across the board, how
• 8:23
  does that actually work in practice? Like, what
• 8:24
  does it tell us about the architecture of these
• 8:26
  systems? What's fascinating here is how interconnected
• 8:30
  modern software has really become. A property
• 8:33
  management system like RMS, it doesn't just sit
• 8:35
  in isolation. It has to talk to accounting software,
• 8:38
  it talks to marketing platforms, and it talks
• 8:40
  to channel managers. Right. Those are the systems
• 8:42
  that sync room availability with sites like Booking
• 8:45
  .com or Expedia. Exactly. And to allow all these
• 8:48
  disparate systems to talk to each other without
• 8:50
  human intervention, they use APIs or application
• 8:54
  programming interfaces. And those APIs require
• 8:57
  credentials to function. Yes. Integration credentials
• 9:00
  like API keys, they aren't just standard passwords.
• 9:03
  You can think of them almost like VIP access
• 9:06
  passes that let two computer programs exchange
• 9:09
  data in the background securely. If a hacker
• 9:12
  manages to steal one of those VIP passes, they
• 9:15
  can walk right past the digital security guards
• 9:17
  because the system inherently trusts the program
• 9:20
  that's presenting the pass. Oh, wow. That makes
• 9:23
  the reissuing of these credentials incredibly
• 9:25
  significant then. Very. While the sources clearly
• 9:27
  state that no one has publicly confirmed exactly
• 9:30
  how the attackers got in, and we certainly cannot
• 9:32
  speculate on the root cause, the act of rotating
• 9:35
  all those API keys suggests a massive effort
• 9:38
  to sever any potential unauthorized lateral movement
• 9:41
  between RMS and its external partners. It's really
• 9:45
  about locking down that complex web of integrations.
• 9:48
  And that complex web is where the true risk lies
• 9:51
  for the local operators. It is just a nightmare
• 9:54
  scenario for vendor management. Which actually
• 9:56
  transitions this perfectly into the business
• 9:58
  reality of this whole situation. Because while
• 10:01
  RMS engineers are dealing with API keys in the
• 10:03
  background, it's the local holiday park's name
• 10:06
  flashing on a panicked guest's phone. Yeah, they're
• 10:09
  the ones taking the heat. Totally. And the sources
• 10:12
  we're synthesizing highlight several critical
• 10:14
  survival tactics for businesses caught in a supply
• 10:17
  chain breach like this. The first major theme
• 10:20
  seems to be vendor management and incident response
• 10:23
  speed. Right. When you rely on a third party
• 10:26
  platform, it is still your business's reputation
• 10:28
  on the line. The guest doesn't care about the
• 10:31
  cloud architecture. They care that they booked
• 10:33
  a cabin with you and now they're being scammed.
• 10:35
  Exactly. So a core takeaway here is that businesses
• 10:38
  must negotiate incident communication speeds
• 10:41
  into their vendor contracts beforehand. If a
• 10:44
  global platform goes down or gets breached, you
• 10:46
  need a contractual guarantee on how fast they
• 10:49
  will notify you and exactly what data they will
• 10:51
  provide so you can actually manage your customers.
• 10:54
  I want to challenge that a bit because it sounds
• 10:57
  great in a boardroom, but let's look at the reality.
• 11:01
  If you are managing a six -park operation like
• 11:04
  the Moineshire, How do you realistically enforce
• 11:07
  cybersecurity standards on a global tech provider?
• 11:10
  That's the real problem, isn't it? Yeah, like
• 11:12
  a local Shire council can't exactly hire a red
• 11:15
  team, you know, a group of ethical hackers, to
• 11:17
  run penetration tests and try to break into a
• 11:20
  global software provider's servers to see if
• 11:22
  they're actually secure. They just don't have
• 11:24
  the leverage. It is a profound David and Goliath
• 11:27
  challenge. You are absolutely right that a small
• 11:29
  operator cannot audit the code of a massive cloud
• 11:32
  provider. But that is exactly why the contract
• 11:35
  terms for notification are really the only true
• 11:38
  leverage they have. Just legally holding their
• 11:40
  feet to the fire. Exactly. Small businesses cannot
• 11:43
  prevent the breach of a major vendor, but they
• 11:45
  can mandate immediate transparency when a breach
• 11:48
  happens. The protection isn't in preventing the
• 11:51
  hack. The protection is in the speed of the response
• 11:53
  and the clarity of the communication to the end
• 11:56
  consumer before the scammers can mobilize. So
• 11:59
  that flows right into the next major theme from
• 12:01
  the sources, which is data mapping and digital
• 12:03
  hygiene. Yes. Businesses need a highly accurate
• 12:06
  map of exactly what data they are collecting,
• 12:08
  where it's being routed, and which third parties
• 12:11
  hold it at any given moment. Furthermore, going
• 12:14
  back to those API keys, you have to treat digital
• 12:16
  integrations with extreme caution. Like physical
• 12:19
  keys. Precisely. You wouldn't hand a master key
• 12:22
  to your physical office to a random contractor
• 12:23
  and let them keep it forever without supervision.
• 12:26
  Digital credentials require that exact same rigor.
• 12:29
  They must be rotated regularly, and each connection
• 12:32
  should only be granted the absolute minimum data
• 12:35
  access required to function. And beyond the technical
• 12:37
  hygiene, there's also the necessity of pre -planned
• 12:40
  communications. If your guests are being actively
• 12:43
  targeted, you can't be drafting a response from
• 12:46
  scratch in a panic. You have to establish the
• 12:48
  rules of engagement with your customers long
• 12:50
  before an emergency happens. That's a huge point.
• 12:53
  For instance... clearly stating on your website
• 12:56
  and in every booking confirmation exactly how
• 12:58
  you will handle payments, and explicitly noting
• 13:01
  channels you will never use. Interestingly, RMS
• 13:05
  actually advised its clients to remind guests
• 13:07
  that they never use WhatsApp for payment collections,
• 13:09
  which is a crucial detail to establish early.
• 13:12
  And we really cannot ignore the heavy legal and
• 13:15
  compliance burden hanging over all of us. all
• 13:17
  of this. Under Australia's Notifiable Data Breaches
• 13:20
  Scheme, which is part of the Privacy Act, organizations
• 13:23
  have a legal obligation when data is compromised.
• 13:26
  Right. If an eligible breach occurs and it is
• 13:28
  likely to cause serious harm to individuals,
• 13:31
  which financial scams certainly qualify for,
• 13:33
  the organization must notify the affected individuals
• 13:36
  and the regulator. But in a tangled web of APIs
• 13:39
  and third -party cloud providers, who's actually
• 13:42
  on the hook for that notification? Is it... the
• 13:44
  local caravan park, or is it RMS? See, that is
• 13:48
  the multi -million dollar compliance question.
• 13:51
  The sources note that whether and exactly how
• 13:53
  this legislation applies is something for RMS
• 13:56
  and its customers to untangle legally. Determining
• 13:59
  who acts as the primary data controller versus
• 14:02
  the data processor in these complex cloud agreements,
• 14:06
  I mean, it often requires teams of lawyers. Which
• 14:08
  just adds a massive administrative burden on
• 14:11
  top of the immediate crisis of dealing with angry
• 14:13
  guests. Exactly. But while these businesses are
• 14:16
  locked in contract disputes and legal obligations
• 14:19
  over these integrations, the real -time fallout
• 14:21
  is happening on your phone right now. Let's look
• 14:26
  at what is still unknown about the live threat
• 14:27
  and how you can actually defend yourself as a
• 14:30
  consumer. Well, as of the reporting cutoff on
• 14:33
  October 31st, there are still significant blind
• 14:35
  spots. We still do not have public confirmation
• 14:38
  on the exact entry vector the attackers used
• 14:41
  to compromise the system. Right. Still a mystery.
• 14:43
  Yeah. And we do not know the precise timeline
• 14:45
  of when the initial unauthorized access actually
• 14:48
  began. We lack a confirmed number of total guests
• 14:51
  or properties affected worldwide. And notably,
• 14:54
  no specific threat actor or ransomware group
• 14:56
  has been officially named or claimed responsibility
• 14:59
  for the campaign yet. There was also a glaring
• 15:01
  contradiction in how this breach is being characterized
• 15:03
  regarding its scale in the reporting. There really
• 15:07
  is. CyberDaily characterizes it as a global incident
• 15:11
  due to RMS Cloud's worldwide customer footprint
• 15:13
  of over 6 ,000 properties. However, the reported
• 15:17
  impact, meaning the actual operators issuing
• 15:20
  warnings and the guests actively receiving scams,
• 15:22
  has so far been heavily isolated to Australia.
• 15:25
  Okay, that's interesting. But we also have to
• 15:27
  attach a vital caveat to this analysis. Similar
• 15:31
  hyper -targeted fake booking messages have been
• 15:34
  reported by customers of entirely different competing
• 15:37
  travel platforms recently. So if you get a scam
• 15:40
  text about a hotel booking today, it doesn't
• 15:43
  automatically mean it came from the RMS breach.
• 15:45
  Exactly. Spirit fishing in the travel and hospitality
• 15:48
  sector is just an industry -wide plague right
• 15:51
  now because the data is so incredibly valuable.
• 15:53
  It is. The travel industry is a prime target
• 15:56
  because the transactions are large, time -sensitive,
• 15:59
  and inherently stressful. It creates the perfect
• 16:02
  environment for psychological manipulation. So
• 16:05
  let's focus on defense. We want to synthesize
• 16:07
  the absolute most actionable advice from these
• 16:10
  sources so you know exactly what to do if your
• 16:12
  phone buzzes with one of these threats. First
• 16:15
  and most importantly, do not click links in failed
• 16:19
  payment messages. No matter how much of a panic
• 16:22
  you are in, stop. Do not let the urgency dictate
• 16:25
  your physical actions. You really have to break
• 16:28
  the chain of trust the scammer is trying to build.
• 16:30
  If you feel the need to verify your payment status,
• 16:32
  do not reply to the text, do not use the phone
• 16:35
  number provided in the message, and absolutely
• 16:37
  do not use WhatsApp. You go directly to the property's
• 16:40
  official website, find their public contact number,
• 16:43
  and call the front desk yourself. If you did
• 16:46
  panic in the moment, and as we established, these
• 16:48
  scams are specifically designed to make highly
• 16:51
  intelligent people panic. and you entered your
• 16:53
  credit card details into a fraudulent link, do
• 16:55
  not wait. Call your bank immediately and lock
• 16:58
  that card. Immediately. And finally, report the
• 17:02
  incident to ScamWatch. The authorities cannot
• 17:04
  track the true scale or the evolving tactics
• 17:07
  of these syndicates if the incidents go unreported.
• 17:10
  If we connect this to the bigger picture, there
• 17:12
  is a final, highly critical warning buried in
• 17:15
  our source material that everyone really needs
• 17:17
  to internalize. Scammers reuse good data. Oh,
• 17:21
  yeah. If they have your accurate contact information
• 17:23
  and booking history, you must expect follow -up
• 17:27
  attacks. They now know your phone number is active.
• 17:29
  They know you respond to travel -related prompts.
• 17:31
  You have been validated and placed on a highly
• 17:34
  curated list for future campaigns. So to summarize
• 17:37
  the core irony of this whole deep dive, an obscure
• 17:40
  cloud platform that most travelers had completely
• 17:43
  never heard of was breached. And while the stolen
• 17:47
  data seemed relatively limited on paper, just
• 17:49
  names, contact details, and booking dates, with
• 17:52
  zero credit cards exposed, it turned out to be
• 17:55
  the absolute perfect recipe to engineer incredibly
• 17:57
  convincing, highly stressful scams. It really
• 18:00
  was. It bypassed our mental security filters
• 18:03
  because it used our own factual history against
• 18:06
  us. And that leaves us with a final thought for
• 18:08
  you to mull over as you navigate an increasingly
• 18:11
  interconnected digital world. If these syndicates
• 18:14
  are holding onto your highly accurate booking
• 18:16
  dates and contact info from this specific breach,
• 18:19
  what happens when they inevitably combine it
• 18:22
  with data from a totally different breach next
• 18:24
  year? That's a scary thought. It is. Perhaps
• 18:26
  a breach that exposes your recent online purchases,
• 18:29
  your medical appointment history, or your child's
• 18:32
  school district. It is what we might call the
• 18:35
  Frankenstein effect of your digital footprint.
• 18:38
  Small, seemingly harmless bits of exposed data
• 18:41
  like... a caravan park booking in October, can
• 18:44
  be stitched together with other stolen data over
• 18:47
  time. Slowly, silently, they build a dangerously
• 18:50
  accurate digital replica of your life. Wow. The
• 18:53
  goal isn't just to steal one payment. It is to
• 18:55
  make future scams virtually indistinguishable
• 18:58
  from reality. The booked holiday that panicked
• 19:01
  you today is just one piece of the monster they
• 19:03
  are building for tomorrow. A terrifying but necessary
• 19:06
  thought to leave you with. Keep your digital
• 19:09
  guard up. and question everything that demands
• 19:12
  your immediate panic. We will see you on the
• 19:14
  next deep dive.