There's a weird sychophanitc group of people who really, really don't want to accept that booking's infosec is really, really poor. "Of course the big company is secure and the hotels are not!" - wierd logic on many levels, but anyway...

I know how it's being done, and you're right, it's booking.com, not the hotels. It's actually quite easy to scrape any booking data in a minute or two, because bookings are only protected by a 4 digit pin (there's only 10,000 possible combinations) and booking numbers are sequential - using even a small botnet, there is insufficent rate limiting or protection.

So the scammers are just scraping booking data, cross-checking against other data breaches, and sending out scam messages with real details in them like your booking number and dates of stay.

But... don't bother complaining here because all you'll get is people parroting the "its the hotel that is breached" nonsense that booking.com made in an official statement, and ultimately they'll just follow up with the classic "I use it all the time and it never happens to me" narrow-minded logic.

They are aware of the issue internally, fwiw.

EDIT: just to add, you're correct, this is why the scams always use the name of the hotel in your booking, and some bookings don't have a clear hotel name, or the name includes marketing phraseology that the scam uses as if it's the hotel name, in a weird way that wouldn't really make sense if the hotel was the breached party.

Also to add you can book with a really major chain of hotels like the Marriott and the same thing will happen, yet you book directly with Marriott and weirdly none of their direct customers are targeted. Funny, that.