The holiday park company Center Parcs has removed links to its old X account from its website after a man who took over the account was contacted by genuine customers.
Center Parcs deleted its X account in January, which meant the @CenterParcsUK handle became available.
Carl Lennon, an IT consultant, registered an X account with this name when he noticed it was available, and said he started getting messages from customers asking to change their bookings.
Center Parcs removed the link after being contacted by BBC News, and conceded the links “should have been removed” from its website when it stopped using X.
“Center Parcs recently deactivated our X channel as it was no longer deemed an effective channel for us to use and our guests have several other ways to talk directly to us,” a spokesperson told the BBC.
Mr Lennon was looking to book a holiday with Center Parcs but changed his mind after he discovered the company was still linking to the dead X account from its website.
“I was effectively thinking of handing over my data to them to do a booking, and thinking, ‘Well, hang on, they don’t seem to have very good security,'” he said.
Companies often use social media accounts as a form of customer support, where people will message them for help.
He has had requests from customers on a range of topics, including requests to change dates, rearrange payments, and add more people to bookings.
“I don’t know the legality of replying to their messages,” he said, adding he has decided not to reply at all and only took on the handle as an experiment.
But he said “someone malicious” could easily respond, asking customers to send payment details or other sensitive information to the X account.
Mr Lennon says he tried contacting Center Parcs through various channels but had not been able to get a response, except for an acknowledgement of an email he had sent.
After being told by BBC News that the link had been removed, he said “they didn’t seem to take it seriously” when he contacted them three weeks ago.
“I’m just a bit gobsmacked that it took them so long to sort out,” he said.
He said he will now deactivate the X account altogether.
Some companies, including fashion brand Balenciaga, US supermarket Target and newspaper The Guardian have left X since Elon Musk took it over in 2022.
In most cases, the accounts are still open but left dormant.
In the case of Balenciaga, the account no longer exists, but cannot be claimed by a new user – suggesting access to it may still held by the company.
