A cybersecurity incident affecting a third-party booking platform used by national parks agencies across Australia has potentially exposed the personal details of thousands of campers and visitors, with authorities in Queensland, Victoria, South Australia, the ACT and Western Australia all confirming they have been affected, just weeks before the peak summer holiday season.
The platform at the centre of the breach is Bookeasy, which processes campsite reservations and visitor permits on behalf of multiple state and territory governments. The company confirmed it first detected unauthorised activity in early November and immediately launched an investigation, engaging cybersecurity experts and taking containment action.
What Information Was Accessed in the Bookeasy Breach
Across the affected jurisdictions, the categories of data potentially accessed are consistent: customer names, contact details and booking information. This includes email addresses, phone numbers and physical addresses stored within the platform.
Authorities have been careful to draw a distinction between personal data and financial data. Queensland Parks and Wildlife Service (QPWS) stated that payments are processed through a separate secure system and that there is currently no indication customers' financial information was compromised. South Australia's National Parks and Wildlife Service similarly told customers there is no evidence credit card details were accessed. Bookeasy itself confirmed it had not detected any breach of financial information.
In the ACT, the government confirmed that approximately 6,000 users had been emailed with warnings about the breach and the risk of follow-up scam activity. The ACT government also confirmed that VisitCanberra, a separate government service used for accommodation and attraction bookings in the territory, was also compromised through the same platform.
Which States and Territories Are Affected
The scale of the incident is significant, with confirmed impacts now spanning five jurisdictions:
- Queensland: QPWS confirmed the breach and is working with Bookeasy to determine the full scope of affected customers.
- Victoria: Parks Victoria has acknowledged the incident and, as a precaution, temporarily suspended all new campsite bookings while its investigation continues. Existing bookings remain valid, though customers are currently unable to make changes or modifications to reservations.
- South Australia: National Parks and Wildlife Service SA notified customers that unauthorised activity was detected within the Bookeasy platform and that names, contact details and booking information may have been accessed.
- ACT: The ACT government has temporarily disabled the Bookeasy platform while assessing the fallout, though direct bookings through the parks government website remain available.
- Western Australia: The Shire of Carnarvon issued a security alert confirming a separate but related incident involving Bookeasy, which manages visitor bookings for the shire.
As of 12 November, there had been no public confirmation that NSW National Parks and Wildlife Service customers had been affected by the incident.
Scam Messages Already Being Reported
Authorities across several jurisdictions are warning the public that suspicious follow-up contact is already occurring. Parks Victoria said it had received reports of suspicious WhatsApp messages being sent to customers about their bookings. The ACT government similarly flagged that some Canberrans had received suspicious messages via email and WhatsApp. The Shire of Carnarvon in WA issued comparable warnings about circulating messages linked to bookings.
QPWS urged campers to be vigilant about fake emails, WhatsApp messages and phone calls falsely claiming to come from the department. The ACT government's executive group manager Bren Burkevics advised residents to exercise extreme caution and treat any unsolicited contact with suspicion.
"The usual message is that avoiding scams is critical in these times," Burkevics said. "Avoid clicking on links and providing sensitive information, particularly credit card information, to third-party applications." He directed the public to scamwatch.gov.au for further guidance.
What Affected Campers Should Do Now
With the Christmas holiday period approaching and national parks among Australia's most popular summer destinations, the timing of the breach has heightened concern. Authorities are urging anyone who has made a national parks or campground booking through an online portal in recent months to take the following precautions:
- Do not click on links in unsolicited emails or messages claiming to relate to a national parks booking.
- Do not provide personal or financial information in response to any unexpected contact, even if it appears to come from a government agency.
- Report suspicious messages to Scamwatch at scamwatch.gov.au.
- Contact the relevant state or territory parks agency directly if there are any concerns about an existing booking.
Bookeasy said its investigation remains ongoing. The company stated that upon detecting the security alert it moved quickly to contain the incident and bring in external cyber expertise, but has not yet publicly confirmed the total number of customers whose information may have been accessed across all affected jurisdictions.
For anyone concerned about how their personal data may be affected by third-party platform security, it is worth reviewing what protections actually apply when a third party holding your information experiences difficulties.
Investigations by Bookeasy and the relevant government agencies are continuing, with further updates expected as the scope of the breach is more fully determined.
