More than 600 disputed reservations had reached Budva’s Tre Canne hotel by 10 a.m. on 19 October after its Booking.com account was compromised, according to Nikola Kavedžić, the lawyer representing hotel operator Fab live. The hotel lost access to its account and control over prices, availability and communications, and is asking the Amsterdam-based platform to restore access and release undisputed funds.
The incident began early on 18 October, when unusually numerous bookings started arriving. Podgorica-based Fab live operates the 14-storey hotel near the Adriatic Fair and the promenade at Slovenska Beach. Its account was altered without authorisation, leaving the hotel’s authorised representatives unable to manage the profile.
Bookings appeared at prices the hotel says it did not set or approve. The hotel recorded offers of about 15 to 17 euros for a night with breakfast, including stays of up to 40 days. A police record also noted information about disputed prices ranging from 20 to 50 euros.
Staff tried to prevent further sales by closing availability, but bookings continued to arrive. The hotel’s operations manager and two receptionists reportedly contacted Booking.com customer support 30 times on 18 October while trying to resolve the problem.
Support directed the hotel representatives to central assistance in the Netherlands. Despite repeated warnings, the disputed activity was not stopped in time and control of the account was not restored, according to the account provided by Fab live’s lawyer. Sales through Booking.com were halted, leaving the hotel unable to manage prices, room availability or communications through the compromised profile.
The volume of expected arrivals disrupted reception operations, caused guest dissatisfaction and prompted accusations against the hotel. One description of the incident reported dozens of guests at reception and almost 200 announced arrivals; Kavedžić separately put the number expected at more than 200 people. These figures concern expected arrivals, while the number of disputed bookings had passed 600 by 10 a.m. on 19 October.
Guests may have received payment links and some amounts may have been collected, but the recipient of the money has not been established. Fab live says it received no payments for the disputed bookings. “Who received the disputed payments?” Kavedžić asked.
The hotel also faced a separate cash-flow constraint at the time of the incident: its bank account was blocked, preventing it from collecting earlier revenue held on a virtual card. The disputed bookings and uncertainty over payments therefore arose while the hotel could not access those previously earned funds.
Fab live filed a criminal complaint with the Budva Security Department’s criminal police station, where a record was made of its receipt. The record documents allegations of unauthorised price changes, a large number of reservations and loss of account access. Budva police are investigating who hacked the account.
Notice seeks account control and payment
Fab live sent Booking.com a formal notice before litigation, seeking immediate protection of the account, restored access for authorised representatives, remediation of the breach’s effects and payment of amounts that are due. The company does not consider the occurrence of a hacking incident, by itself, proof that Booking.com is liable. It says the platform’s response after receiving warnings must also be examined.
The notice identifies concerns about what Fab live describes as inadequate and delayed support, the transfer of hotel representatives between support teams, and the possibility that reservations continued to be confirmed or payment instructions sent after the reports. It asks whether Booking.com took available measures promptly once alerted, rather than treating the breach itself as sufficient to establish responsibility.
The company disputes automatic charges for refunds, alternative accommodation, commissions, penalties and other amounts arising from the bookings. It says it does not challenge guests’ legitimate right to refunds, but objects to charging the hotel before the legal basis, payment flow and responsibility for each disputed booking have been established. The notice says Fab live “expressly disputes charges arising from reservations” resulting from unauthorised changes.
For each disputed charge, the hotel wants the booking identifier, the time it was created and changed, the amount and currency paid, and details of the recipient to the extent permitted by law. It is also seeking evidence of the transaction and any refund, together with the contractual basis for charging the hotel.
The request separates disputed transactions from legitimate bookings and virtual cards. Fab live wants a review of valid reservations and virtual cards, including available amounts, activation dates, payment due dates, collection deadlines and the reason for any restriction. It is seeking an accounting of undisputed amounts due and access to collect them through virtual cards or receive lawful payment to a verified account of an authorised recipient.
Within 24 hours of receiving the notice, Booking.com was asked to confirm receipt, issue an incident number, identify a responsible contact, secure the accounts, preserve evidence and temporarily suspend collection of disputed charges. Within 48 hours, the company was asked to establish a secure identity-verification process for restoring access, revoke unauthorised sessions and access, and check prices, availability, related parties, integrations and payment details.
Fab live also asked the platform to enable an appropriate account after the checks and allow the hotel to enter and confirm a lawful bank account. Within 48 hours of receiving the notice, Booking.com was asked to provide a calculation of undisputed amounts due and enable collection through virtual cards or lawful payment to a verified account belonging to an authorised recipient.
The hotel requested that Booking.com preserve electronic evidence from at least 17 October until the incident is fully resolved. The requested material includes login and IP address records, password and authentication changes, user permissions, changes to prices, availability and bank details, access to connected systems, messages, payment links, reservations and transactions.
The evidence request also covers support reports, internal escalations and any call recordings. Fab live wants the records retained to document account access, subsequent changes, payment activity and the handling of the hotel’s reports. It also asked the platform to keep evidence while the disputed charges and account access are reviewed.
In an email response to Kavedžić, an agent wrote: “I am currently out of the office until 2 November 2026 and have limited access to email.”
