Travellers who booked with Transcontinents, in Réunion, are receiving fake WhatsApp messages that already know their hotel, dates of stay and booking reference. The agency confirms that unauthorised access to its system enabled data to be extracted on 20 and 21 October 2026. The fraudsters then use this information to demand urgent confirmation, sometimes accompanied by a request for payment.
For customers, that is precisely where the trap lies: the travel details are correct, but the sender is not who they claim to be. A valid booking reference is no longer enough to authenticate a message.
Genuine information in a fake request
In its alert, updated on 30 October, Transcontinents describes messages that purport to come from the hotel. They invite recipients to follow a link within a very short time. The agency says it never asks people to confirm a booking or pay via a link sent on WhatsApp or by SMS.
The extracted data include names, email addresses, telephone numbers, and information about hotels, flights and dates. According to the company, the compromised system does not store banking data, so these are not included in the stated scope of the extraction.
That does not eliminate the risk of fraud. Stay information can be used to persuade travellers to enter their card details on a page controlled by the scammers. The initial theft provides the context; the fake confirmation seeks to obtain payment or the information that is still missing.
A Réunion-based agency and targeted customers
Cyberattaque.org, which reported on the incident on 6 November, notes that Transcontinents has been based in Réunion since 1959 and has six agencies. The company sells, among other things, holidays in the Indian Ocean, air tickets and hotel bookings.
The publication highlights the targeted nature of the approaches: they use genuine travel information rather than messages sent at random. It says that the number of affected customers and the volume of extracted data have not been made public. Any losses resulting from the scam attempts have not been quantified either.
The alert is aimed at people affected by this data extraction, not all travellers in Réunion. Nor does it establish that the systems of the hotels named in the messages were themselves hacked. Their names may have been used because they appeared in a booking.
Check your stay without following the link you received
The first step is to contact the agency using a number you already know or have found on its official website. Transcontinents also gives the number 0262 94 28 00. It is best to use these contact details rather than reply to the number that has just sent a cancellation threat.
An urgent message does not prove that a booking is genuinely at risk. Before paying a second time or entering information, ask your usual contact to confirm the status of the booking. The agency can then check the booking in its own systems, without the traveller sending their details to the suspicious sender again.
This advice is in line with Cybermalveillance.gouv.fr’s prevention guidance: if in doubt, contact the organisation whose identity is being used directly. The public service also points out that the address of a fraudulent website may differ only very slightly from that of the genuine service.
If you have already entered your bank details
You should contact your bank promptly. Transcontinents recommends cancelling the card, filing a complaint with screenshots of the message, and notifying the agency. Cybermalveillance also advises keeping evidence, particularly the message received, and cancelling the card if payment details have been shared or fraudulent transactions are found.
The situation is different if you have only received the message. In that case, avoid the link and report the sender. If you have entered a password on a fake page, the public service recommends changing it on the genuine website and also changing it anywhere else you reused it.
These steps address specific risks. They do not assume that every recipient has paid, that every bank card is compromised or that all trips must be cancelled.
Access blocked, data monitoring continues
Transcontinents says it has blocked the unauthorised access, strengthened the security of its system, notified the CNIL and filed a complaint. The agency says it will inform affected customers individually by email.
However, blocking access does not make the information already copied disappear. Travellers should therefore remain alert to further approaches relating to their stay, both before departure and after it. The right response is still to check with the known travel provider, even when a message knows the planned trip in detail.
Illustrative photo: use of WhatsApp, unrelated to the fraudulent messages in this case. Santeri Viinamäki / Wikimedia Commons / CC BY-SA 4.0.
