Bookeasy breach hits national park bookings in Queensland, Victoria and South Australia

People who booked camping or vehicle access in national parks in Queensland, Victoria or South Australia may have had their details reached after a breach at Bookeasy, the third-party system those states use for park bookings. Queensland’s environment department, Parks Victoria and South Australia’s parks service have all confirmed the incident. Here’s what they have said so far, and how to tell a real parks message from a fake one.

What happened

ABC News reported on November 12, 2026 (already November 11 in much of North America) that the Queensland Department of Environment, Tourism, Science and Innovation had been told Bookeasy was hacked. Bookeasy processes camping and vehicle access permits for the National Parks Booking System and stores personal emails, addresses and phone numbers.

A department spokesperson told ABC that, at this stage, they did not believe customers’ financial information was accessed, because payments are processed through a separate system. The department said it would give affected customers more information as it learns more, and asked park users to be wary of phishing attempts by people impersonating national park staff.

“If you receive an unexpected email, text message or phone call claiming to be from the department and asking you to confirm or provide personal information, do not respond, click on any links, or provide any personal information,” the spokesperson said. Suspicious activity should be reported to Queensland Parks and Wildlife Service at QPWS@detsi.qld.gov.au.

Victoria and South Australia

The same booking provider is used in other states, and they have issued their own notices.

Parks Victoria said on November 11 that it is aware of a broader data issue affecting Bookeasy, and of reports of suspicious WhatsApp messages being sent to some customers about their Parks Victoria bookings. As a precaution, it has temporarily suspended all new campsite bookings while it investigates. Existing bookings have not been cancelled and remain valid, but changes or modifications to existing bookings are temporarily unavailable.

Parks Victoria is clear on one point: it does not communicate with customers via WhatsApp. If you get an unexpected WhatsApp message about a Parks Victoria booking, it says, don’t click links, don’t provide payment or other personal details, and don’t make a payment in response.

National Parks and Wildlife Service South Australia, in an email quoted by ABC News, told users that Bookeasy recently detected unauthorised activity on its platform and has hired cyber security experts to investigate. “As part of this investigation, it has been identified that some customer information, including names, contact details, and booking information, may have been accessed,” the email said. “At this stage, there is no evidence that credit card details were accessed.”

None of the three agencies has, in these notices, said how many people were affected, when the access began, or whether the data was copied.

What you can do

1. Expect a message from the parks service you booked with, not from a random WhatsApp account or an unexpected payment link. Parks Victoria says it does not use WhatsApp to contact customers.
2. Don’t confirm personal or payment details in response to an unexpected email, text, call or chat that claims to be from a parks department.
3. Check an existing booking on the official parks booking site you used, by typing the address yourself. In Victoria, new bookings and changes are paused for now; existing bookings still stand.
4. If you already entered details or paid after a suspicious message, contact your bank or card issuer and report it to the parks service for the state you booked in. In Queensland, the department has given QPWS@detsi.qld.gov.au as the address for suspicious activity.
5. Learn the patterns. See how scammers use leaked data to make phishing personal.

How Frame helps

If this breach is added to a catalog, add it to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give a booking service its own address, so a fake parks message that arrives at the wrong one stands out. Frame never collects or stores the leaked records themselves.

Related coverage

• Fake hotel payment pages now show your real name, dates and room price: another travel booking scam that uses real reservation details.
• How scammers use leaked data to make phishing personal: why a message that knows your booking still may not be genuine.

Sources

• ABC News, Personal user data breached after Qld, Victoria and SA's National Park booking systems hacked, November 12, 2026
• Parks Victoria, Suspicious WhatsApp messages linked to booking system issue, November 11, 2026