Last updated: 23 September 2026

We are providing information about a security incident involving the hotel software service provider used by our hotel.

On 25 July 2026, unknown attackers gained unauthorised access to systems operated by ibelsa GmbH. The service provider’s current public statement, including its update of 20 August 2026, is available on the ibelsa website. The statement is available in German.

According to ibelsa, its external forensic specialists have completed their work. They could not establish precisely whether data was taken or identify specific affected records. The available indications suggest that the attacker may have obtained reservations that were for future stays as of July 2026. ibelsa says it cannot narrow the possible impact down to individual hotels or groups of people.

We must therefore continue to assume, as a precaution, that information relating to guests and customers of Garden Hotel Krefeld may have been affected. We cannot determine from ibelsa’s findings whether a particular person’s data was obtained.

Data that may have been affected

Depending on what was recorded with a reservation, potentially affected information may include names, contact details, travel dates and other booking information. The precise data fields and records involved have not been established.

ibelsa states that it can rule out with a high degree of confidence that ibelsaPay payment data was obtained. This statement relates specifically to ibelsaPay payment data; it does not establish which other information, if any, was accessed or taken.

We have used the affected hotel software since November 2025. Data from our previous hotel management system was not transferred to it. A person who stayed with us before November 2025 may nevertheless have a record in the current system if a new booking or contact record was created later.

Please remain particularly vigilant

Data protection authorities and DEHOGA have warned of phishing and fraud attempts involving genuine booking details. Fraudsters may contact guests by email, text message or WhatsApp while pretending to represent a hotel or booking platform.

Such messages may contain a correct name, hotel, travel date or other reservation detail and may therefore appear convincing. Correct booking information alone does not prove that a message genuinely comes from us or from a booking platform.

Fraudulent messages may ask guests to make an urgent payment, enter payment or credit card details, or confirm a booking through a link. They may threaten to cancel the booking if the recipient does not comply.

Please observe the following precautions:

Check unexpected messages, links and payment requests relating to your booking carefully.
Do not trust a message solely because it contains correct booking information.
Do not enter payment, credit card or login details through a suspicious link.
Only make payments or change payment details through channels you have verified.
Do not transfer money to an unfamiliar bank account or one communicated to you at short notice.
Do not allow short deadlines or threats of cancellation to pressure you.
If in doubt, contact us using the official contact details published on our website.
If you have already provided payment or credit card details or made a payment, contact your bank or credit card provider immediately.
If you have entered login details or passwords, change the affected passwords immediately. Where appropriate, report the incident to the police.

Information about our payment links

In certain cases, Garden Hotel Krefeld sends payment links through the booking and payment system used by our hotel.

Please check the sender information and the web address displayed in every payment link. If you receive an unexpected payment request, or if the sender, web address, bank details or content appear unusual, do not enter any payment details or make a payment.

Instead, call us at +49 (0) 2151 53523-0. We can confirm whether a payment request or payment link genuinely originated from us.

Further information on protecting yourself against fraud is available from the State Commissioner for Data Protection and Freedom of Information of Mecklenburg-Western Pomerania and the German Consumer Advice Centre. These resources are available in German.

Measures taken by us

After becoming aware of the incident, we implemented additional security measures. These included:

changing all passwords for the hotel software,
changing the login credentials for email accounts connected to the hotel software,
activating multi-factor authentication for all hotel software users,
reviewing user accounts and access permissions, and
reviewing relevant system connections and increasing their monitoring.

We also directly notified guests and customers for whom we had email addresses, informed our employees about potential phishing and fraud attempts, and reported the incident to the data protection supervisory authority responsible for our hotel.

Based on the information currently available, we have no indication that Garden Hotel Krefeld’s own systems were directly attacked or compromised. We will update this notice if material new information becomes available.

Contact

If you have any questions or receive a suspicious message, please contact us:

Garden Hotel Krefeld
Wolfram Lawall e.K.
Schönwasserstraße 12A
47800 Krefeld
Germany

Contact person:
Steve Lawall
Telephone: +49 (0) 2151 53523-0
Email: datenschutz@gardenhotel.de