Data breach in national parks booking system affects multiple states, exposing personal information

Consensus Summary

A major data breach in the national parks booking system has exposed the personal information of visitors across multiple Australian states, raising concerns just weeks before the peak holiday season. The breach originated with Bookeasy, a third-party provider managing bookings for Queensland Parks and Wildlife Service (QPWS), Victoria, South Australia, and Western Australia’s Shire of Carnarvon. Hackers accessed names, contact details, and booking information, though there is no evidence financial data was compromised, as payments are processed separately. Customers are now being targeted by phishing scams, including fake emails, texts, and WhatsApp messages impersonating park authorities, prompting warnings to avoid sharing personal details or clicking suspicious links.

The breach stems from unauthorized activity detected by Bookeasy in early November, which the company immediately investigated alongside cybersecurity experts. While QPWS and other affected agencies are collaborating to assess the scope, the incident has forced Parks Victoria to temporarily halt new campsite bookings as a precaution. Existing reservations remain valid, but customers are advised to avoid making changes until the investigation concludes. The timing of the breach is particularly concerning, given the upcoming Christmas holiday period when national parks and camping grounds are expected to see heavy traffic.

Key figures involved include QPWS, which has urged vigilance against phishing attempts and provided a dedicated email (QPWS@detsi.qld.gov.au) for reporting suspicious activity. Bookeasy has confirmed it engaged external specialists to contain the breach and is notifying affected partners. Both agencies emphasize that no credit card details were accessed, though they continue to monitor the situation. In Western Australia, the Shire of Carnarvon separately issued a security alert, while NSW has not yet confirmed whether its customers were impacted. The departments have stressed they will share further updates as the investigation progresses.

While both ABC and 7NEWS agree on the core details of the breach, some differences emerge in emphasis. ABC focuses on QPWS’s direct warnings and the specific email address for reporting concerns, whereas 7NEWS highlights the broader multi-state impact and includes additional context about WhatsApp-based scams. Both sources also note the breach was detected in early November, though 7NEWS explicitly ties the confirmation to November 12. The reporting underscores the urgency of the situation, with agencies urging affected customers to remain cautious and proactive in protecting their personal information.

As of November 12, the investigation remains ongoing, with QPWS and Bookeasy working to determine the full extent of the breach and the number of affected individuals. Customers who have received suspicious communications are advised to delete them immediately, avoid clicking links, and contact their banks if they’ve shared payment details. The agencies have pledged to provide further information as soon as it becomes available, though the immediate focus is on mitigating the risks of phishing and identity theft in the wake of the breach.