Security notice for guests with a booking
Safety notice for guests with a booking
Safety notice for guests with a booking
This notice concerns bookings at the following establishments and data controllers: MYND Adeje (Hotel Callao Adeje, S.L.) and MYND Yaiza (Hotel New Trend, S.L.). The incident is being managed under the coordination of Canarian Hospitality, the group to which these establishments belong.
On 15 October 2026, an unauthorised third party exploited a flaw in the online check-in application and reception kiosks, supplied by a technology provider, and obtained data from some bookings with arrival dates between 19 October 2026 and 10 January 2028. The flaw was detected and fixed on 19 October 2026.
What data has been affected? Full name, address, email address, telephone number and booking details (dates of stay, booking number and room). If you completed online registration before your arrival, your identity document or passport has also been affected. No bank or payment card details have been affected.
What is happening? Fraudulent messages are being sent, mainly via WhatsApp, impersonating our hotels, using real booking details and requesting payment through a link to an external platform. These messages do not come from us.
What do we recommend?
• Do not make any payment or provide bank details through links received by WhatsApp, SMS or email. MYND Hotels will not ask you for payments through these channels.
• If you receive a message about your booking, do not reply or click on any link. Verify it by calling (+34) 922 97 09 65 or writing to info@myndhotels.com.
• Be wary of messages that convey urgency or threaten to cancel your booking.
• If you have already made a payment or provided your card details, contact your bank immediately, file a report with the Police or the Guardia Civil, and let us know.
• If you completed online registration in advance, watch out for any misuse of your identity document, such as contracts, loans or service sign-ups you do not recognise, and report it if you detect any.
What have we done? The provider has fixed the flaw and strengthened access controls, the access credentials for the application have been changed, and we have notified the incident to the Spanish Data Protection Agency (AEPD).
Your booking remains fully valid and you do not need to do anything to keep it. For any queries or to exercise your data protection rights, you can contact our Data Protection Officer at rgpd@canarianhospitality.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).
We sincerely apologise for any inconvenience this situation may cause you.