Dear Guests,

We hereby inform you of a personal data breach relating to the reservation management system used by Hotel Lero.

Most importantly, according to the information currently available, your payment card data has not been affected.

What happened

A third party unlawfully accessed part of the reservation management system. According to the findings available so far, the data that may have been affected relates to your reservation and may include your name and surname, e-mail address, address, and reservation details, such as the reservation number, dates of stay and property name.

According to the findings available so far, the database itself has not been compromised and the system remains safe for continued use. Your reservation remains valid and you do not need to make any changes to it.

What this means for you

Since the above data may have been accessed by a third party, there is a risk that someone may try to contact you by falsely presenting themselves as Hotel Lero or as our partner. Such attempts have already been recorded. Their purpose is to persuade you to authorise a payment, transfer money, or obtain your payment card details.

How to recognise a scam

Such messages may be sent by e-mail, WhatsApp or similar communication channels. To appear credible, they often include real details of your reservation, such as your name, reservation number or dates of stay. They often threaten that your reservation will be cancelled within a short period of time unless you immediately make a payment or confirm your details, and they direct you to a link where you are asked to enter your card details.

This is not how we communicate with our guests.

What we kindly ask you to do

- Do not open links contained in such messages.
- Do not enter your card details and do not make any payments based on such messages.
- Do not reply to such messages and do not share your personal data with anyone.
- If you are unsure whether a message is genuine, do not use the contact details contained in that message. Please contact us directly through the official contact details of Hotel Lero or through the details provided in your original reservation confirmation, and we will be happy to verify this for you.

Please note that Hotel Lero never requests payment or confirmation of card details through a link contained in a message.

If you have already acted upon such a message

If you have already entered your payment card details or made a payment based on such a message, we recommend that you immediately contact your bank or card issuer, report the potential fraud and request instructions on further measures to protect your card and dispute the transaction. The sooner you act, the easier it is to prevent or reduce any damage.

What we have done

As soon as we became aware of the breach, in cooperation with the reservation system provider, unauthorised access was restricted and the system was additionally secured. External cybersecurity experts have been engaged to determine the circumstances and scope of the breach, and additional security measures are being introduced to prevent recurrence. We are also monitoring the described fraud attempts and will inform you of any important updates in due course.

For any questions regarding this notice, we remain at your disposal.

For questions related to personal data protection, you may contact the Data Protection Officer of Hotel Lero at: marko@rasica.eu.

We apologise for any inconvenience caused and thank you for your understanding.

Sincerely,

Hotel Lero