UMC Utrecht data breach exposes information of 5,000 guesthouse visitors

University Medical Center Utrecht has disclosed a data breach affecting roughly 5,000 people who booked stays at its guesthouse, after hackers broke into the reservation system operated by an outside software provider. The Dutch academic hospital notified the country’s data protection authority of the incident and began emailing affected guests directly.

The breach traces back to VIPS PMS, the property management system company that runs the guesthouse’s booking platform. An intruder gained unauthorized access to the system on August 2, 2026, and the hospital learned of the compromise on August 6.

The exposed information includes guests’ names, home addresses, email addresses, phone numbers, gender and stay details such as arrival and departure dates. UMC Utrecht said the intrusion did not touch financial records, patient files or any health-related data, a distinction the hospital cited in describing the breach’s overall risk as limited.

Even so, hospital officials cautioned that the stolen contact and booking details could be exploited in follow-up scams delivered by email, text message, phone call or WhatsApp. Guests were urged to treat unsolicited messages about their reservations or payments with suspicion.

"We ask you to be extra vigilant for unexpected messages regarding your stay or payment," UMC Utrecht said, adding that the guesthouse never requests advance digital payment from guests and that bills are settled at checkout. The hospital said it also does not solicit payment information through email or WhatsApp.

Following discovery of the breach, VIPS PMS brought in an external cybersecurity firm to determine how the attacker penetrated the booking system and accessed guest data. The company moved to contain the damage by cutting off the external access route used in the attack, forcing a reset of login credentials, preserving records tied to the investigation, and rolling out expanded monitoring and activity logging across the platform. Additional security measures were also put in place, though further specifics were not disclosed.

A spokesperson told regional broadcaster RTV Utrecht that approximately 5,000 guesthouse guests were affected by the breach, matching the figure UMC Utrecht reported to the Dutch data protection authority.