TUI Belgium confirmed on 12 October that it is investigating a data breach following reports of customers receiving WhatsApp and e-mail messages containing accurate booking details. The fraudulent messages asked recipients to “verify” or pre-pay for holidays by clicking embedded links, raising fears that malicious actors have accessed personal travel data. The tour operator has not disclosed the scale or origin of the breach but said initial indications point to Belgian bookings only. Cyber-security experts note that the inclusion of precise travel dates and payment amounts in the messages significantly increases the risk that victims will comply, potentially handing over credit-card details or passport scans. For mobility teams and expatriates who rely on TUI for family travel, the incident is a timely reminder to channel-check any unexpected requests. Companies should circulate anti-phishing guidance and remind employees to confirm payment demands through official TUI portals or phone lines. Under Belgium’s GDPR implementation, TUI has 72 hours to notify the Data Protection Authority and affected customers once the breach is confirmed. Failure to do so could result in fines of up to 2 % of annual revenue. The company says it has engaged external forensic specialists and is cooperating with law-enforcement agencies. While no flight disruptions are expected, the episode highlights the expanding cyber-risk surface that accompanies international mobility. HR and travel departments may wish to audit supplier data-protection measures as part of broader duty-of-care obligations.
Source: Aviation24.be
