Booked a national park campsite? The Bookeasy hack has reached Canberra, and the ACT has switched its booking site off

The data breach at national parks booking provider Bookeasy has spread to the ACT, where the territory government suspended the platform on Saturday and warned about 6,000 customers to be on guard against scams.

Bren Burkevics, an executive group manager in the ACT government, said Bookeasy had reported a cyber incident and “potentially the unauthorised release of information”. The government suspended the website “in the abundance of caution”, he said, and urged “extreme caution” about unexpected messages. The ACT government said VisitCanberra, its booking system for accommodation and attractions, had also been compromised, and that some Canberra campers had already received suspicious messages by email and WhatsApp.

Bookeasy said it took “immediate containment action” after a security alert and had brought in cyber security experts. It said customers’ personal and booking information, including email addresses and phone numbers, may have been compromised, but that it had found no access to financial or card details. Canberrans can still book campsites and attractions directly through the ACT parks website, and the government is pointing people to Scamwatch at scamwatch.gov.au.

How did this start?

The provider behind Queensland’s national parks bookings suffered a data breach, the Queensland government confirmed on Thursday morning.

The Department of the Environment, Tourism, Science and Innovation said third-party provider Bookeasy, which manages the Queensland National Parks Booking Service, had been hacked. The service handles camping bookings and vehicle access permits for the state’s parks.

Bookeasy held customers’ email addresses, physical addresses and phone numbers. The department said it was working with the company to find out exactly what had been affected and was contacting affected customers directly. It has not said how many people are involved or when the breach happened.

“We take the privacy and security of your information extremely seriously,” a department spokesperson said.

Is my card safe?

The department says that at this stage it does not believe financial information was accessed, because payments are processed through a separate, secure system. Anyone who has already handed card details to someone claiming to be from national parks should call their bank straight away.

What should I watch for?

The bigger risk is what comes next. Names, addresses and phone numbers tied to a recent camping trip give scammers a convincing story: a “refund”, a “cancelled permit”, a “booking problem” that needs a link clicked or a payment made.

The department’s advice is to check with it first. Do not reply to unexpected emails, texts, WhatsApp messages or calls asking for personal details, passwords or payments, and do not click links or open attachments. Anyone who has clicked a link should run an antivirus scan and change their passwords. Suspicious contact can be reported to [email protected].

Why does this keep happening?

The breach sits in a supplier, not in the department’s own systems, the same weak point behind many of Australia’s biggest leaks, including the 2025 Qantas breach through a third-party customer platform. Government services increasingly run on outsourced booking and payment software, and each provider holds a copy of the public’s details.

The booking website remained open on Thursday morning, with a notice about the breach at the top of the page.

Who else is caught up?

The ACT is now the fourth. Earlier in the week, Parks Victoria said on Wednesday it had become aware of suspicious WhatsApp messages about bookings, linked to what it called a broader data issue affecting Bookeasy, and temporarily suspended all new campsite bookings. Its booking pages now say the system is offline while Bookeasy conducts a forensic investigation.

Existing Victorian bookings have not been cancelled and remain valid, but they cannot be changed for now. Parks Victoria says it does not contact customers through WhatsApp, and anyone who receives such a message should not click links, pay or hand over personal details.

South Australia’s National Parks and Wildlife Service has emailed its customers too. It said Bookeasy had detected unauthorised activity on its platform and brought in cyber security experts, and that names, contact details and booking information may have been accessed. “At this stage, there is no evidence that credit card details were accessed,” it said.

That means a South Australian camper’s booking dates and park could be in the same hands as their phone number, which makes a fake “booking problem” message all the more convincing.

VNN will update this story as more is confirmed.