Hotel chain Travelodge is investigating an apparent attack on its online customer database making it the latest internet firm to suffer at the hands of hackers looking for personal data.
The incident has been reported to the UK's information commissioner (ICO) who can fine businesses for poor data protection.
In March 2011, travel website TripAdvisor had part of its e-mail database hacked and at the end of April, the PlayStation network ground to a halt after a cyber-attack on personal details.
Travelodge: It looks like the hotel chain could be the latest victim of cyber criminals
A letter to customers, signed by Guy Parsons, Travelodge's chief executive, contained limited details about the nature of the leak, although the firm was keen to stress that the company had not sold users' personal data on to anyone.
It also included details of a spam e-mail that had been sent out to some of the database, which Travelodge customers should be weary of.
The message read: ‘Good day. Don't miss exciting career opening. The company is seeking for adult video self-motivated people in United Kingdom to help us spread out our activity in the UK area.'
Christopher Graham, a spokesperson for the ICO, told the BBC that they were looking into the Travelodge reports.
He said: ‘We will be making enquiries into the circumstances of the alleged breach of the Data Protection Act before deciding what action, if any, needs to be taken.'
The ICO has the power to levy fines of up to £500,000 on companies which are shown to have failed to protect personal information entrusted to them.
Phising scams have grown in prominence in recent years. An email arrives that looks like it is from a bank or another reputable company.
The message asks the recipient to 'update', 'validate', or 'confirm' details and directs the unwitting to a fake site.
Personal information and passwords are then harvested so scammers can raid accounts, run up bills or commit financial crimes in other people's names. Personal information is also sold onto third parties.