Photograph: Onyango George / EA Hospitality Pulse

The breach happened at the software company. Under three East African laws, it is the hotel that has to report it.

By Onyango George (OG)

A French hotel software publisher lost roughly 135GB of guest records from about 1,500 establishments between 27 September and 5 October, and the fraud calls began the next day carrying real booking references. The East African exposure is not French, it is structural. Kenya gives a hotel 72 hours from the moment it finds out and gives its software vendor 48 hours to tell it, Tanzania gives no number at all, and Uganda says immediately. Hospitality is on Kenya's register-regardless-of-size list, and the sector's instinctive answer to a data penalty so far has been a sign at the door.

The messages went out on 6 October, by WhatsApp and by email, and what made them work was that everything in them was true. The guest's name was right. The hotel was right. The dates of the stay were right, and so was the booking reference. The only thing that was wrong was the link, which led to a site asking for card details to settle a deposit that had never been outstanding. Guests who had done nothing more exotic than reserve a room in Paris were being defrauded with their own reservation data, less than 48 hours after it left the building.

It had not left their hotel. It had left Medialog, a French publisher of management software for hotels and restaurants whose product handles reservations and guest stays for a long tail of independents and small groups, heavily concentrated in Paris. According to the incident reconstruction published by the French breach-tracking outlet FrenchBreaches on 6 October, a weakness had been present in the affected applications since 29 June. The first traces of unauthorised access date to 27 September, when the intruders helped themselves to the names and statuses of around 1,650 establishment accounts. They then sat inside the system for a week. The mass extraction ran from two o'clock on the afternoon of 4 October until 07:46 the following morning, around 135GB of full customer records from about 1,500 establishments. Medialog detected the activity on the morning of 5 October and blocked it at 11:03.

What went out, on the vendor's own account, was identity and stay data: full names, dates and places of birth, nationalities, postal and email addresses, telephone numbers, and then the hotel, the reservation, the room, the booking status, the identity of the payer, the voucher number and the deposit amount. Medialog says no card numbers, expiry dates or security codes were taken, and no identity document numbers or photographs, and that it has closed the vulnerability and hardened its authentication. It also told the affected hotels to work out for themselves whether they owed the CNIL a notification, and to tell their guests promptly where the risk warranted it.

That last instruction is the whole story, and it is the reason this is an East African story rather than a French one. The hotels did not choose the vulnerability, did not know about the intrusion for the week it ran, and could not have blocked it. They are nonetheless the ones holding the legal obligation, because in every data protection regime that matters here the hotel is the controller and the software company is the processor. Dan Timilsina, a security and risk management professional with more than fifteen years at luxury properties in the UAE, Nepal and Japan, put the principle in one line in Security Management on 26 August: "Accountability to guests cannot be transferred through a vendor contract." He was writing before Medialog. He was describing it exactly.

The practical content of that accountability, in East Africa, is a set of clocks that start when the vendor decides to pick up the telephone. Kenya's Data Protection Act 2019 requires a controller to notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of a notifiable breach, and requires a processor to notify its controller within 48 hours of becoming aware. Identifiable individuals must then be told in writing within a reasonably practicable period, and a controller that decides not to tell them has to explain that decision to the Commissioner. A breach becomes notifiable when an unauthorised person has accessed personal data and that access threatens meaningful harm, a test that names, identity numbers, income details and card or bank information all comfortably meet. Fail the whole of it and the administrative ceiling is five million shillings or one per cent of the prior year's annual turnover, whichever is lower, with a separate criminal track running to three million shillings or ten years.

Cross the border and the clock changes shape. Tanzania's Personal Data Protection Act, Chapter 44, requires notification to the Commission under section 27(5) "without undue delay", and the Act does not define the phrase. It does not condition notification on harm either, which makes the Tanzanian duty simultaneously broader and vaguer than Kenya's: every breach is reportable, on a deadline nobody has written down. There is no statutory duty to tell the guest at all. The penalty under regulation 63 of the 2023 Collection and Processing Regulations runs from 100,000 shillings to five million, with up to five years' imprisonment available alongside it. Uganda is blunter still. Section 23 of the Data Protection and Privacy Act and regulation 33 of the 2021 regulations require notification to the Personal Data Protection Office "immediately" upon reasonable belief that data was accessed by an unauthorised person, the duty bites directly on processors as well as controllers, and the Office rather than the hotel decides whether guests are told. Corporate fines there can reach two per cent of annual gross turnover.

So a group running one shared reservation system across Nairobi, Arusha and Kampala has three incompatible answers to the same question, and the strictest of the three is the one with no number attached. None of the three clocks can start before the vendor speaks. In the Medialog case the vendor was seven days behind the intruders and the fraudsters were a day ahead of the vendor.

This is not an exotic risk being imported into a region that does not face it. It is the ordinary structure of a modern East African hotel's technology estate, in which the property management system, the channel manager, the booking engine and the payment gateway are all somebody else's software running on somebody else's infrastructure, mostly outside the country. Kenya still has no operational hyperscaler region: the $1bn Microsoft and G42 geothermal data centre that was to host one had stalled by 2026 on power capacity, and local commercial capacity, such as iXAfrica's 4.5MW first phase, is growing from a small base. Guest data therefore sits abroad by default, which is a lawful choice and also a practical one, and which means the logs that would establish when a hotel became aware of a breach are held by a company in another jurisdiction with no particular incentive to hurry.

Against that, the sector's demonstrated posture is thin. The one time Kenyan hospitality has been publicly penalised under the Act it was for something far simpler than a vendor compromise. In September 2023 the ODPC fined Casa Vera Lounge 1.85 million shillings for posting a reveller's image on social media without consent, part of a tranche of three penalty notices totalling 9.375 million shillings, and the regulator's position was stated plainly: clubs "do not have the right to post photos on social media without consent". The industry's response was not to review how it processed guest data. It was to put up signs. Tribe Onyx told arrivals that "your entry and presence on the premises constitute your consent to be photographed, filmed, and/or otherwise recorded". Quiver Lounge Kilimani and Texas Barbeque ran near-identical notices ending "do not enter the area if you do not agree to the foregoing". A door disclaimer is a consent instrument. It is of no use whatever when the exposure arrives through a processor in Europe, which is the distinction Timilsina was drawing when he wrote that "compliance and governance are not the same thing", and that "risk in the modern hotel environment does not live at the perimeter".

The compliance baseline, meanwhile, is not optional for this sector in either of the region's two largest hospitality markets. Kenya's ODPC lists hospitality among the categories that must register regardless of turnover or headcount, so the exemption for businesses under five million shillings and ten employees does not reach a lodge; certificates run 24 months and have to be renewed thirty days out. Tanzania's registration window closed on 8 April 2026 with full enforcement of the Act from the following day, and tourism companies were named explicitly among the registrable sectors, alongside banks, hospitals and telecommunications firms. Enforcement in the region is no longer theoretical: Kenya's ODPC determined 96 complaints in 2025, close to double the 2024 figure, and Uganda secured its first criminal conviction under its Act on 10 July 2025, against a microfinance director prosecuted for operating without registration.

There is one more thing operators should notice about the moment this breach landed. Kenya's regulator is between commissioners. Immaculate Kassait, the inaugural Data Commissioner appointed in 2020, is completing a single six-year term; the Public Service Commission received 152 applications by 14 September, shortlisted thirteen candidates including the Media Council's chief executive David Omwoyo and the ODPC's own senior deputy Oscar Otieno Onyango, and held interviews on 5 October, the same weekend the Medialog data was being carried out of the building. A regulator in transition is not a regulator that has stopped counting days. Kassait herself framed the asymmetry in June, talking about humanitarian technology but describing something more general: while new systems "bring greater efficiency and reach, they also introduce new and evolving risks".

The work that follows from all this is unglamorous and almost entirely contractual. Mugambi Laibuta, now chair of the Data Privacy and Governance Society of Kenya, made the point six years ago, when the Act was new and the industry was treating it as an expense: businesses should map their data, prioritise it and check the data governance of their suppliers, because "having shareholders, management, staff and agents sign non-disclosure agreements is insufficient". For a hotel in October 2026 that means knowing which vendor holds which guest field, having a processing agreement that actually obliges the vendor to notify within the 48 hours Kenyan law assumes, knowing who can read the access logs and how fast, and having a notification already drafted so that the 72 hours are spent verifying rather than writing. None of it will prevent the next Medialog. All of it determines whether the hotel's name appears in that story as a victim or as a respondent.

The uncomfortable part is that the absence of a reported East African hotel breach proves nothing. A vulnerability can sit open in a hosted application from late June to late September without anyone noticing, and the first people to tell a hotel's guests that something has gone wrong can be the people defrauding them. Kenya, Tanzania and Uganda have each decided how quickly a hotel must speak once it knows. Not one of them has given an operator any way to find out sooner.