Dear Guest,
We would like to inform you about a data security breach affecting the Hotellinx Cloud reservation system used by Santalahti Resort. The incident was detected on Wednesday, 7 October 2026.
The system provider, Vitec Hotellinx, has informed us that, as a result of the breach, some accommodation guests’ reservation information may have been accessed by unauthorised parties.
Where did the security breach occur?
Santalahti Resort uses Hotellinx Cloud, a cloud-based reservation and property management system provided and maintained by Vitec Hotellinx. Customer and reservation information is stored and processed in this external service provider’s system.
The security breach affected the reservation system maintained by Vitec Hotellinx. Based on the information currently available, there is no indication that Santalahti Resort’s own website or other systems directly managed by us have been compromised.
Santalahti Resort remains the data controller for its customers’ personal data and is investigating the incident in cooperation with the system provider.
What happened, and who may be affected?
Vitec Hotellinx detected the security breach on 7 October 2026 at 7:30 PM. The possible source of the issue was identified at 8:30 PM, and corrective measures were completed by 11:00 PM.
According to the system provider’s current assessment, the breach is likely to affect reservations with an arrival date of 6 October 2026 or later.
The exact timing and extent of the breach are still under investigation. Not all readers of this notice have necessarily been affected.
The information potentially exposed includes guests’ names, contact details, accommodation dates and other reservation-related customer information.
Payment information has not been compromised, according to the system provider
According to Vitec Hotellinx, customers’ payment information is not stored in the affected hotel reservation system and has not been exposed as a result of this breach.
However, potentially exposed reservation details may be used in fraudulent messages attempting to obtain guests’ payment card information.
Warning about fraudulent messages
We have already become aware of fraudulent messages sent to guests in connection with their accommodation reservations.
These messages may contain genuine reservation details, making them appear trustworthy. For example, they may ask guests to confirm a reservation, make an additional payment or provide payment card details through an external website.
We strongly advise all guests to take the following precautions:
- Do not open payment links in suspicious messages.
- Do not provide payment card details or online banking credentials in response to suspicious messages.
- If you receive an unusual payment or reservation confirmation request, verify its authenticity by contacting Santalahti Resort directly.
- If you have already entered your payment card details on a suspicious website, contact your bank or card issuer immediately.
- If you receive a suspicious message, please report it to us at info@santalahti.fi.
Are existing reservations still valid?
Based on the information currently available, the security breach does not require guests to make any changes to their accommodation reservations.
You may continue to contact us as usual regarding your reservation or any other enquiries.
What is being done to investigate the incident?
Vitec Hotellinx is investigating the incident in cooperation with external cybersecurity specialists.
Santalahti Resort is closely monitoring the situation, assessing any potential impact on our guests and fulfilling its data protection obligations as the data controller.
We will provide further updates if the investigation reveals significant new information relevant to our guests.
We sincerely apologise for the incident and for any concern or inconvenience it may cause. Protecting our guests’ personal information is very important to us.
Further information and contact details
Santalahti Resort Oy
Santalahdentie 150, 48310 Kotka, Finland
Telephone: +358 5 260 5055
Email: info@santalahti.fi
Website: https://santalahti.fi
