All articles

Published on · Italy

ID documents stolen from Italian hotels: what happened and what changes at the front desk

Between June and July 2025 someone got into the systems of several Italian hotels and took the scans of the documents collected at check-in. In August they were put up for sale. Italy's data protection authority opened an investigation and later clarified something many hotels do not know: those copies should not have been kept.

In 30 seconds

  1. Someone took the scans of guests' ID documents from at least twelve Italian hotels and put them up for sale.
  2. Those copies should not have been kept: they are only needed for the police registration, then they must be deleted.
  3. Today: find and delete the copies left at the front desk, in your software and on WhatsApp.
When
June and July 2025, for sale from August
Where
At least 12 hotels in Italy
How they got in
Not made public
What they took
Scans of passports and ID cards

What happened

On 6 August 2025 CERT-AGID, the Italian public body that tracks cyber incidents, raised the alarm: on a criminal forum a seller calling themselves «mydocs» was offering high-resolution scans of passports and ID cards of guests at Italian hotels, collected during check-in.

Over the following days the list grew: by 13 August ten properties were involved, and two more were added on 14 August. According to the seller, the documents were taken between June and July 2025.

Sources do not agree on the number of documents: the figures are in the tens of thousands. On 13 August the Italian data protection authority opened an investigation.

How they got in

It has not been made public. The seller talks about unauthorised access to the hotels' systems, without saying how. We do not guess. What matters for anyone running a property is something else: the documents were there, stored, and so they could be taken.

Why it is serious

With a scan of a real document someone can create fake IDs, open accounts or apply for credit in another person's name. That is the risk CERT-AGID itself points to: identity theft. The guest finds out months later, and the hotel's name stays tied to the story.

What the Italian authority clarified

In a clarification note dated 29 April 2026 the authority wrote that public security law does not require accommodation providers to keep a copy of the document: it is only needed to enter the data into the police system Alloggiati Web. As soon as the system issues its receipt, the digital copy must be erased and any paper copy destroyed.

The note also asks for clear instructions to staff: no copies of documents are made or kept after the legal notification. Among the reported practices it mentions asking guests to send their documents over WhatsApp.

What to check in your business today

  1. After sending guest data to the police system, delete the scans and destroy the photocopies. Check the front desk scanner too: many keep a copy on their own.
  2. Look for forgotten copies: shared folders, the property management system, the front desk mailbox, WhatsApp chats.
  3. Turn on two-step verification for the front desk mailbox and the booking system.
  4. Ask your software provider in writing where uploaded documents end up and how long they stay there.

Sources