Important Information About a Security Incident

DATA PROTECTION OFFICER'S STATEMENT

Dear Client,

Cordial Hotels & Resorts is contacting you to inform you of a security incident involving one of our technology service providers, Consultores Canarios de Informática, S.A. (trading as NORAY), which has affected personal information relating to your booking.

What happened?
On Friday 6 November at 20:57 (Canary Islands time), Consultores Canarios de Informática, S.A. (trading as NORAY) informed us that your booking was among those affected by a security breach suffered by this technology service provider between 18:00 on 2 November 2026 and 09:00 on 3 November 2026 (Canary Islands time). Unauthorised third parties gained access, through a cyberattack, to an intermediate server operated by Noray, where the provider stores bookings received from the Channel Manager before transferring them to the Noray Property Management System (PMS).

Consultores Canarios de Informática, S.A. is the developer of the property management system marketed under the name NORAY, which is used by Cordial Hotels & Resorts and many other Spanish hotel groups which have also, unfortunately, been affected by this cyberattack.

Consultores Canarios de Informática, S.A. (trading as NORAY) has assured us that, as of 5 November 2026, it had fixed the vulnerability in its system that made the attack possible.

As a result of this incident, fraudulent messages have been identified being sent via WhatsApp to some of our guests, in which unauthorised third parties impersonate Cordial Hotels & Resorts. These communications may include genuine booking details and ask recipients to confirm or validate their stay via links to fraudulent websites, with the aim of obtaining banking information or making unauthorised charges. These messages have been sent from accounts such as “Ooredoo Maldives” and “Honda BigWing Silk Board”. Please be aware that the senders may vary.

We would like to remind you that Cordial Hotels & Resorts does not use WhatsApp or SMS to request booking confirmations, payments or personal information, or to offer additional upgrades to your booking.

Your booking remains valid, and no further confirmation is required as a result of this incident.

What data may have been affected?
According to the information provided by our service provider to date, the personal data that may have been affected includes:

• First and last name.
• Telephone number.
• Email address.
• Booking information: property, stay dates and booking reference.

Consultores Canarios de Informática, S.A. (trading as NORAY) has assured us that passport details and residential addresses have not been compromised.

Cordial Hotels & Resorts does not store guests' credit card details, as payments are processed through secure payment gateways.

Possible consequences of the incident
Unauthorised access to this information could facilitate:

• The sending of fraudulent communications by email, SMS or messaging applications such as WhatsApp, purporting to come from Cordial Hotels & Resorts or the property where you are staying.
• Impersonation attempts aimed at obtaining further personal or banking information.
• Fraudulent payment requests through links to websites designed to resemble official booking confirmation channels.

What can you do?
We recommend that you remain particularly vigilant and follow these precautions:

• Do not click on links included in suspicious messages, even if they contain genuine details of your booking.
• Do not provide personal details, passwords or banking information through links received via WhatsApp, SMS or email.
• Do not make payments or confirm your booking through channels other than the official Cordial Hotels & Resorts channels.
• Do not download files or respond to communications from unknown senders.
• If you have provided your card details or made any payment through these links, contact your bank immediately to block your card and dispute the charges.
• If you have disclosed any passwords, change them as soon as possible.
• Block and report fraudulent contacts directly through the WhatsApp application.

You can find further information on how to protect yourself against this type of fraud on the website of the Spanish National Cybersecurity Institute (INCIBE): https://www.incibe.es. You can also call its free cybersecurity helpline on 017.

If you have received any suspicious communication relating to your booking, you can send us any information you have available, such as screenshots or the sender's details, to dpo@becordial.com.

Measures taken
As soon as we became aware of the incident, we activated our internal security incident management protocol and, together with our service provider, have taken the following measures:

• The service provider suspended access to the affected systems and booking services, changed the access credentials for external channels and disconnected the affected server.
• A specialist cybersecurity company has carried out a technical analysis of the attack on behalf of Consultores Canarios de Informática, S.A. (trading as NORAY) and is continuing to investigate its scope. We have requested that the provider implement the necessary corrective measures to prevent further unauthorised access.
• We have reported the incident to the Spanish National Police.
• We have notified the Spanish Data Protection Agency (AEPD) of the incident.

We will continue to monitor the situation and will inform you if any further information comes to light that may affect you.

Contact
Should you have any questions regarding this incident, you can contact our Data Protection Officer at dpo@becordial.com.

We sincerely regret any inconvenience or concern this situation may have caused and would like to reaffirm our commitment to protecting your personal data.

Kind regards,
Data Protection Officer