What happened?
We use SuperControl, a third-party booking platform, to manage bookings for our holiday cottages. Late on 1 November 2026, SuperControl found unauthorised activity on parts of its platform where guest and booking information can be accessed, and told us the next morning. SuperControl has told us this affects many holiday letting businesses that use its platform, not only ours.
On 7 November, guests who had booked with us through Airbnb contacted us about fake WhatsApp messages that included their real booking details. This confirmed that some of our guests’ information was accessed. SuperControl has told us similar messages are also being sent by email and possibly by text.
SuperControl is still investigating, and has not yet told us exactly which bookings or how many guests are affected.
What information may have been affected?
Based on what guests have reported and what SuperControl has told us so far, the fake messages have used:
- your name
- your phone number
- your booking dates
We have no indication that other information was accessed, but SuperControl has not yet confirmed exactly what was. We will update this page as soon as it does.
Were payment card details affected?
No. Card payments are processed by Holiday Rent Payment, a separate secure payment service that was not affected by this incident. Your full card number is not stored in the booking system.
When you book with us directly, we take your deposit on our website, then email you a secure payment link for the balance. Both payments go to Holiday Rent Payment. If you are unsure whether a payment email is genuine, contact us before you pay.
If you see a payment on your account that you do not recognise, contact your bank or card provider straight away.
I booked through Airbnb or another site. Am I affected?
Bookings made through cottages.com, Airbnb, Vrbo, and Google Vacation Rentals are also recorded in our booking system, and the first fake messages we heard about were sent to guests who booked through Airbnb.
If you booked through one of these sites, only use that site’s own app or website to message us or make payments. Airbnb and Vrbo never ask you to pay outside their own website or app.
What should I do?
You do not need to do anything right now. Please be careful with any unexpected message about your booking, especially one that:
- arrives on WhatsApp, by email, or by text from a number or address you do not recognise
- says your booking will be cancelled unless you act quickly
- asks you to pay by WhatsApp or text, pay again, or confirm your card details
Scammers may use your real name, dates, and cottage to make a message look genuine. Knowing your booking details does not prove a message is from us.
How can I check a message is really from you?
Contact us using the details below, which are also on every page of this website. Do not use a phone number, email address, or link given in the message itself.
Genuine emails from us come from:
- holidaycottages@glenkindieestate.uk or holidaycottages@glenkindieestate.co.uk, when we write to you ourselves
- Glenkindie Estates Limited, at an address ending in @secure-booking-email.net, when our booking system sends your confirmation or payment link
Before your stay, we also email your arrival information, including the contact details of our local representative.
A familiar sender is not proof on its own. If any message asks you to pay again, pay a different account, or send card details by reply, contact us before you act on it.
What if I clicked a link or paid?
- If you only clicked a link and did not enter any details, you do not need to do anything else. Delete the message.
- If you entered card or bank details, or made a payment, contact your bank or card provider immediately, then report it to Police Scotland on 101 (or your local police if you live outside Scotland).
- If you entered a password, change it straight away on any account where you use it.
Please also let us know, and send us a screenshot of the message if you can. It helps us and SuperControl with the investigation.
How do I report a scam message?
- WhatsApp: block and report the sender in the app.
- Text messages: forward them for free to 7726.
- Emails: forward them to report@phishing.gov.uk, run by the UK National Cyber Security Centre.
- cottages.com, Airbnb, or Vrbo messages: report them through that site’s help centre.
- Tell us too: email holidaycottages@glenkindieestate.co.uk with a screenshot and your booking reference. Please do not include passwords, card details, or access codes.
What are you doing about it?
SuperControl has told us it brought in independent cyber security specialists and legal advisers, took steps to contain the activity, and has found no evidence that it is still going on. Its investigation continues. On our side, we have:
- reset the passwords for every account we use to access the booking system, and turned on two-step verification
- checked the connections between the booking system and the sites we list our cottages on, such as cottages.com, Airbnb, and Vrbo
- asked SuperControl for a full review of who accessed our booking information
- briefed our team so they can help guests who call about a suspicious message
- contacted guests who booked through Airbnb, and are contacting all other guests
Have the authorities been told?
Yes. We reported this to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, on 9 November 2026.
Why am I getting this if I have not had a suspicious message?
SuperControl has not yet confirmed exactly which guests are affected, so we are letting all of our guests know as a precaution. It does not mean your details have been misused.
Your rights and how to complain
Glenkindie Estates Limited (registered in Scotland, SC762391) is responsible for your personal information as the data controller for Glenkindie Holiday Cottages. You can ask what information we hold about you, or ask us questions about this incident, by emailing holidaycottages@glenkindieestate.co.uk. Our Privacy & Cookie Policy explains how we use your information.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Will you update this page?
Yes. We will update this page as SuperControl shares more information, and we will contact you directly if we learn that your information was affected in a way that needs you to take action.