TUI Belgium Reports Breach of Maspalomas Hotel Booking Data

TUI Belgium has been hit by a cyberattack that exposed customer booking data tied to hotel stays in Maspalomas, the resort district on Gran Canaria in Spain's Canary Islands, according to a local outlet covering the incident.

Maspalomas24h.uk reported the breach this week. The leaked dataset contains guest reservation records from Maspalomas properties sold through TUI's Belgian distribution channel.

No TUI Belgium executive comment appeared in the maspalomas24h.uk dispatch. The operator has not, as of the report, named the affected hotel partners or specified which data fields the file contained.

What does the breach change for sellers of travel?

Five-front exposure sits downstream of any booking-data leak.

• Reissuance: any rescheduled or re-booked holiday adds labor that package margins cannot absorb.
• Chargebacks: payment disputes on European card rails typically follow a confirmed leak.
• Notification: GDPR's 72-hour rule, the obligation to report a breach to the relevant national regulator within 72 hours of awareness, sets a hard clock.
• Reputation: travelers weighing Canaries alternatives usually switch inside the same booking window, not the next.
• System segregation: any audit the Maspalomas property performs lands on the hotel.

TUI Group, the Hanover-headquartered tour operator and OTA (online travel agency) whose Belgium unit ranks among its larger Western European source markets, prices Canary Islands packages against competing bed-nights in mainland Spain.

Maspalomas product normally sells into Belgian departure airports as winter-sun capacity, putting the disclosure inside an active booking period for the 2025–26 winter program.

Where does the legal exposure land?

Belgium's APD/GBA (the federal data protection authority, formally the Autorité de protection des données / Gegevensbeschermingsautoriteit) governs the notification timeline. Under GDPR Article 33, controllers report a breach to the regulator within 72 hours of awareness. Impact then surfaces through any follow-up enforcement notice or civil claim downstream.

Spain's AEPD holds no direct jurisdiction over TUI Belgium. Maspalomas properties, which sit on Spanish soil, may still face parallel reviews if guest records route through Spanish servers.

For partner hotels, operational drag already runs ahead of any fine. Comparable disclosures at peer operators — Marriott's 2018 incident and Cathay Pacific's in the same year — produced partner FAQ bulletins and centralized notification through the operator's own channels rather than through the property.

Hoteliers and agents should not wait for TUI's official note. Reissuance queues and chargeback disputes will follow within days if the file contains payment data, the standard outcome for booking platforms that store card tokens.

What remains unknown?

Three items sit unresolved.

• The exact count of affected bookings.
• The data fields included.
• The system segment breached inside TUI Belgium.

The next credible detail will most likely reach agents through TUI partner communications before the next Canary Islands pricing release, when the operator typically updates rate cards for the February peak. Watch the Belgian regulator's first public statement — that filing sets the breach's first verified customer count and the formal scope of any compensation claim downstream agents may face as contracting intermediaries.