A shocking independent review has found that Travelodge's hotel staff let strangers into people's rooms 60 times - four years after a man sexually assaulted a woman in her bed after he was given a key to her room. 

In December 2022, 29-year-old Kyran Smith was given a key to a colleague's Travelodge room in Maidenhead after lying to a receptionist that he was her boyfriend. He went on to sexually assault her and was jailed for seven and a half years this February. 

Nothing was done by staff at the time, other than handing over appropriate CCTV to police - until after March 6, 2026, when the scandal broke in the national media and the then-CEO, Jo Boydell, became aware of it. 

Now, an independent review by Paul Greaney KC has revealed that 'room intrusions' by strangers were still happening this summer - months after Smith's conviction and during Travelodge's period of supposed improved security training. 

Mr Greaney called the findings 'disturbing' and claimed the shocking findings of inadequacy in customer safety are likely a problem 'across the hotel sector'. 

The review commissioned earlier this year after Smith's conviction conducted a mystery shopper investigation, in which undercover investigators tested the security of five Travelodges across the country. 

Incredibly, the investigators were able to gain access to a room that wasn't theirs in all five hotels tested through a housekeeper - without having to prove their right to access or being sent to reception. 

Indeed, in two of the hotels, the room number of a guest was announced publicly on check-in - for anyone nearby to hear - and 80 per cent of the time, the receptionist did not ask to add a second person's name to the system when the investigator checked in with another person. 

The findings from the mystery shopper test in April were so concerning that Mr Greaney issued an urgent alert to Travelodge, requiring them to issue further guidance to all staff to adhere to the new policies. But since then, further breaches were found to have occurred. 

One woman, 44-year-old marketing consultant Wendy Griffith, told the Mail how she woke up to a man performing sex acts outside her door while staying at a Travelodge in east London in August last year. 

She called reception at the time, but had no answer. She was then forced to call 999 and wait for the police to arrive and arrest the man, 40-year-old Trevor Reece. 

It was later discovered that he had been told her room number by reception by pretending he had lost his key card. 

In the period of changes being enacted, there were reports by real guests of room intrusions across nearly one in 10 Travelodge hotels - around 60. 

A separate focus group exercise conducted by Mr Greaney in the Maidenhead hotel where the terrible December 16, 2022 attack by Smith happened found that no supervisor had checked that staff had understood the key security training. 

They observed a member of staff incorrectly check in a couple and not follow the routine procedure that had been outlined, and junior female employees even expressed concern for their own safety at work. 

Mr Greaney concluded in the 70-page review published on September 21: 'To say the least, all of the above reflects extremely poorly on Travelodge as a business. 

'I consider that Lily* was fundamentally failed by Travelodge as an organisation at every stage. So too was the general public, because what Lily's case reveals about the inadequacy of the room security processes created a risk for all guests, as subsequent reports to the media and to me confirm. 

'As I go on to explain, I received evidence that the problem with room security exposed by Lily's case is not one restricted to Travelodge, but instead exists across the hotel sector. Change needed to occur, and still needs to occur, across the sector, not just within Travelodge.' 

The budget-friendly chain accommodation, which has 600 hotels, 13,000 staff and annually welcomes over 22million guests, said in response to the findings today: 'Travelodge is committed to addressing the issues raised by this report in a thorough and accountable way and will undertake independent progress assessments after 6 and 12 months. 

'When this assault came to the attention of the Travelodge Board in March this year, it instigated a large-scale programme of change to drive improvements across both hotel operations and customer services.' 

The review also revealed Travelodge's egregious failures in handling Lily's* sexual assault in December 2022. 

It detailed how, when Lily reported that a man had entered her room while she was asleep in bed that night to staff, their response was to offer 'no support or assistance of any meaningful nature'. 

Mr Greaney wrote: 'Their conduct was lacking in any understanding of their safeguarding responsibilities and was not remotely trauma informed. 

'As I have ultimately found, this was principally the result of a lack of adequate training of them in the topic of Violence against Women and Girls ('VAWG') and the existence of an unacceptable culture within Travelodge in which room intrusions were tolerated.' 

Indeed, despite Lily and her manager informing staff again what happened the next day, no internal investigation to find out what happened was triggered. 

Two days after the incident, when police arrived at the Maidenhead Travelodge on December 18, all staff did was hand over the appropriate CCTV. 

Lily made a formal complaint early in the New Year in 2023 addressed to, among others, the Chief Executive Officer (CEO), Jo Boydell, detailing her ordeal and stating 'I want to ensure this is dealt with appropriately and does not happen to someone else'. 

But due to a flawed internal process, the email did not come to the CEO Boydell's attention at that stage - or at any stage during Smith's subsequent trial and conviction - until March 6, 2026, following media reporting on the scandal. 

From the formal complaint email, Travelodge appointed the same member of staff who Lily had initially reported the incident to, at Travelodge Maidenhead.  

The subsequent 'investigation' was 'inadequate' and 'downplayed to a substantial extent the seriousness of what had happened', the report found. 

Nothing further was done with the complaint email, and there was no review of room security policies. 

Insultingly, Lily* was offered a refund of the night's stay after her sexual assault - equivalent to £30. 

The report called the response 'simply appalling' and said the response was 'driven not by a genuine desire to resolve Lily's concerns and learn from her experience' but by 'a desire to get rid of the complaint as quickly and cheaply as possible'. 

It added: 'Lily's treatment by members of Travelodge staff in December 2022 was nothing short of disgraceful, but that was largely down to systemic failures by Travelodge as an organisation, as opposed to failings by the individuals concerned

'I am highly critical of the policies and procedures that were in place for room security in Travelodge hotels in 2022. 

'The policies and procedures were capable of ready exploitation and circumvention by a hostile actor such as Kyran Smith. They were not fit for the purpose of keeping guests safe.'

A victim personal impact statement written by Lily and read to the court at Smith's trial said: 'From the perspective of Travelodge and because the assault happened there, I feel that there is no way I would want to stay in a hotel again on my own. 

'It comes from being in a position of trust. I did not expect this kind of thing from Kyran, and I certainly did not expect to be put in such a position by the Travelodge's lax security procedures … customers have a right to feel safe and secure in their own rooms. I certainly did nothing wrong and ensured my door was locked and shut.' 

A spokesperson for Royal Borough of Windsor and Maidenhead said: 'We take the issues raised by this incident extremely seriously and will be discussing the findings of the independent report with South Oxfordshire District Council, who are Travelodge's primary authority, in line with our responsibilities for enforcing health and safety legislation.

'We'll also consider any relevant implications through our Community Safety Partnership, including our work to tackle violence against women and girls.' 

Jo Boydell stepped down as Chief Executive Officer of the Group on August 17, 2026. Ray Reidy, who had been Chief Financial Officer since April 2025, was since appointed interim CEO. 

Responding to the report today, Mr Reidy said: 'The independent review published today makes it clear that there were failures in Travelodge's room access security policies and procedures and in the way customers have been treated. 

'I apologise unreservedly on behalf of Travelodge to all guests where we have failed, and particularly to Lily. 

'We have made significant progress in preventing and addressing these issues over the past six months, and we recognise we still have further to go. We are working hard to transform our customer service so we respond appropriately when things don't go right. We will continue to improve so customers get the right level of support and empathy when they need it most.

'That is why we are dedicating significant resources as well as implementing governance changes needed to drive the ongoing improvements. We will continue to work with UKHospitality and other partners to elevate standards both within Travelodge and across the wider sector.

'I would like to thank Paul Greaney KC for the robust recommendations and all the valuable suggestions in the review. We are committed to making the changes required to improve safety and security in our hotels.'

*The victim's name has been changed to protect her identity.