Update
RMS has now notified the Australian Cyber Security Centre (ACSC), the Office of the Australian Information Commissioner (OAIC) and the National Office of Cyber Security regarding this incident.
Our investigation remains ongoing, and we will continue to liaise with these regulators while assessing any further notification requirements.
Posted Oct 30, 2026 - 06:04 UTC
Update
Our investigation is ongoing. On Monday, 26 October 2026, RMS identified unauthorised access to a limited part of its environment. We have implemented additional containment, monitoring and access control measures, and our teams are working around the clock with forensic, cyber and legal specialists.
Current findings indicate a subset of guest booking information held in our system is involved, including guest contact information and booking details. Credit card and payment details are not involved.
What customers should do:
While the investigation continues, we recommend providing guidance to your guests on a precautionary basis to remain vigilant against phishing communications. Guest communication guidance is available in the RMS Help Centre: support.rmscloud.com
Posted Oct 29, 2026 - 07:47 UTC
Update
While our investigation is ongoing, current findings indicate a subset of guest reservation information held in our system is involved, including guest contact information and reservation details. Credit card and payment details are not involved.
RMS is also aware of phishing communications sent by an unknown entity claiming to be RMS or one of RMS’ customers. The communications quote reservation information, request confirmation of payment details, and may be received via email, text message or WhatsApp.
We are treating this matter with the utmost urgency, and recognise the concern and disruption this has caused our customers and their guests.
Our team is working around the clock, supported by forensic, cyber and legal specialists, to investigate, support affected customers and understand the full extent of the impact.
We are working closely with affected customers to make sure their guests have clear information and practical guidance while our investigation continues.
Posted Oct 28, 2026 - 07:46 UTC
Update
We continue to monitor for suspicious activity. As a precaution, we've issued new credentials to our integration partners and working with them to complete the change. Some partners and customers will be contacted to update their integration details. If you're unsure whether a request is genuine, contact RMS Support using your usual contact details before acting on it.
We are pursuing the removal of the websites and contact channels used in the scam. Guidance for properties, including an email template you can send to your guests, is in our Help Centre article: https://support.rmscloud.com/hc/en-gb/articles/18149918999823-Security-Incident-Alert-WhatsApp-Phishing-Scam
We know you want more detail about what happened and what it means for your property. We are preparing a fuller update and will share more throughout the day as it becomes available.
RMS will never ask you or your guests for card details or payment through WhatsApp.
Our next update will be no later than 5:00 pm AEDT today, 28 October.
Posted Oct 27, 2026 - 22:18 UTC
Monitoring
RMS is investigating reports of guests receiving phishing messages via WhatsApp, SMS and email that reference genuine booking information and ask recipients to confirm payment details or make a payment.
These messages are not being sent by RMS.
Our teams are actively investigating the activity and taking steps to contain it, protect customer information and support affected customers and integration partners. Some integrations may experience brief interruptions while this work continues.
No payment card information has been exposed from RMS.
We will provide our next routine update by 9:00pm AEDT tonight, or sooner if there is a material change.
Please subscribe to this incident for automatic updates.
Posted Oct 27, 2026 - 05:35 UTC
This incident affects: Australia (RMS9+ (Live), RMS 9+ (Release Candidate), RMS9+ (Beta), RMS REST API, RMS Online API, RMS Public API, RMS Channel Manager, RMS IBE, RMS ePOS, Reports), RMS Support (RMS Customer Support Telephone System, RMS Service Requests), North America (RMS9+ (Live), RMS 9+ (Release Candidate), RMS9+ (Beta), RMS REST API, RMS Online API, RMS Public API, RMS Channel Manager, RMS IBE, RMS ePOS), China (RMS9+ (Live), RMS 9+ (Release Candidate), RMS9+ (Beta), RMS REST API, RMS Online API, RMS Public API, RMS Channel Manager, RMS IBE), Europe (RMS9+ (Live), RMS 9+ (Release Candidate), RMS9+ (Beta), RMS REST API, RMS Online API, RMS Public API, RMS Channel Manager, RMS IBE, RMS ePOS), Modules (RMS SMS Module, MFI - Multi Function Interface), and RMSPAY, RMS Website.