Booked a campsite this year? The company behind park bookings in four states and territories has been hacked, and the scam messages have started
Bookeasy, the private company that runs national park bookings and permits for the ACT, Queensland, Victoria and South Australia, has confirmed that customers' names, contact details and booking information may have been accessed in a cyber attack. Campers have already reported suspicious emails and WhatsApp messages, and governments are warning anyone who booked in the past year not to click links or hand over card details.
Three things to know
- Bookeasy says it has not detected any access to credit card details; Queensland says payments run through a separate system. Names, addresses, emails, phone numbers and booking details may have been taken.
- Parks Victoria has suspended new campsite bookings and the ACT has disabled its booking platform; existing Victorian bookings remain valid but cannot be changed or cancelled for now.
- The danger is the follow-up: scammers who know where and when you booked can send messages that look genuine. Parks Victoria says it does not contact customers through WhatsApp.
If you booked a campsite, a vehicle permit or a park attraction in the ACT, Queensland, Victoria or South Australia in the past year, your details may now be in the hands of criminals.
Bookeasy, which processes bookings and permits for national park systems in those four jurisdictions, says it detected unauthorised activity in early November. It has told its government partners that customer names, addresses, email addresses or phone numbers, along with booking details, may have been accessed. “Following a security alert, we were able to take immediate containment action,” the company said. It says it has engaged cyber security experts, has not detected access to credit card details, and intends to notify regulators.
Who is affected?
Queensland’s Department of Environment, Tourism, Science and Innovation named Bookeasy as the hacked provider last Thursday. It said financial information was not believed to have been accessed because payments are handled by a separate system, and warned of phishing by people pretending to be park staff.
South Australia’s National Parks and Wildlife Service told users to remain vigilant. In Victoria, Parks Victoria suspended new campsite bookings and said it was aware of suspicious WhatsApp messages.
On Saturday the ACT government temporarily disabled its campground booking platform and emailed about 6,000 users. Its tourism booking service, VisitCanberra, was also caught up. Bren Burkevics, an executive group manager in the ACT department, warned people not to click links or give sensitive information, especially card details, to third-party apps.
Bookeasy is advising its partners to warn customers with upcoming bookings and anyone who booked in the past 12 months.
Why does booking data matter if no card numbers were taken?
Because it makes a scam believable. A message that knows your name, your phone number, the park you are going to and the dates of your trip is far more convincing than a random text. Campers in the ACT have already reported suspicious messages by email and WhatsApp. Queensland has warned specifically about people impersonating park staff.
What should you do?
- Do not click links in unexpected emails, texts or WhatsApp messages about a park booking, even if they mention your real trip.
- Never give card details or passwords to anyone who contacts you. Go to the park agency’s own website or phone line yourself.
- In Queensland, report suspicious contact to the parks service at [email protected]. In the ACT, bookings can be arranged through the Namadgi Visitor Centre while the platform is down.
- Check scamwatch.gov.au for current scams, and contact IDCARE, the national identity and cyber support service, if you think you have been caught.
Why does it keep happening?
Governments increasingly hand bookings, permits and payments to specialist platforms, which means one breach at a single supplier can reach customers in several states at once. In this case the park agencies people dealt with were not hacked themselves; the company they all relied on was.
The timing is awkward, with summer and the long school holidays, peak camping time, only weeks away.
How we got here
The key moments that brought this story into focus. Open any moment for detail.
Early November 2026Breach detected
Bookeasy detects unauthorised activity on its systems.
12 November 2026Queensland names Bookeasy
Queensland, Victoria and SA warn park users; Parks Victoria suspends new campsite bookings.
14 November 2026ACT shuts its platform
The ACT disables its booking system and emails about 6,000 users.
16 November 2026Parks Victoria update due
Parks Victoria said it would update customers today.
What happens next
Parks Victoria said it would give an update on its booking system on Monday 16 November. Bookeasy says an independent expert is checking that the breach has been contained and that it will notify regulators. Customers who booked in the past 12 months should expect a notice from the relevant park agency, and should treat any message asking for payment or a click with suspicion.
Sources
- VNN
VNN never names people who give us information in confidence. How we protect sources and tips.
That is the story in a minute. For the evidence, context and what happens next, switch to the full story.
Comments
0 commentsCommunity rules
To read and join the conversation, please agree to our rules.
You have agreed to the community rules.
No comments yet. Start the conversation.