Travelodge "Fundamentally Failed" Woman Given Room Key to Sex Attacker, Independent Review Finds

An independent review has concluded that Travelodge "fundamentally failed" a woman who was sexually assaulted by a man who obtained a key to her hotel room, with the barrister leading the inquiry finding that the chain's security arrangements at the time were "not fit for the purpose of keeping guests safe."

Barrister Paul Greaney KC published his findings on 1 October 2026, examining how Kyran Smith was able to trick reception staff at the Travelodge hotel in Maidenhead into handing him a key to the victim's room in December 2022. Smith falsely claimed to be the woman's boyfriend, and the review found he was given the key less than three minutes after approaching the front desk.

The receptionist who handed over the key had received no training whatsoever in key security, the review found. Greaney emphasised that responsibility lay with Travelodge as an organisation rather than with individual employees, and said a workplace culture had taken hold in which room intrusions were dismissed as "one of those things."

Smith was jailed for seven-and-a-half years in January following the attack, and the case gained national prominence in March 2026 when the victim contacted the BBC to say it raised serious questions about room security across Travelodge's estate. At the time of the assault, the review found the company's security policies were wholly inadequate for protecting guests.

The inquiry also uncovered troubling evidence that the problem extends well beyond a single incident. Room intrusions were reported at nearly one in 10 Travelodge hotels during the summer of 2026, according to the review, and the company had no policy in place addressing violence against women and girls. Those findings suggest a systemic weakness rather than an isolated failure by one member of staff.

The handling of the victim's complaint emerged as one of the most damning elements of the review. In January 2023, the woman emailed a complaint addressed to chief executive Jo Boydell and other senior figures. The review concluded that the email was dealt with by Boydell's office without her knowledge, meaning it did not come to the chief executive's attention until March 2026 — more than three years after it was sent.

Compounding that failure, the complaint was investigated by a manager who had himself been criticised within it. The customer services team subsequently offered the woman a refund for her night's stay, which she understood to amount to £30 — a response the review effectively characterised as inadequate given the seriousness of what had occurred.

Boydell stepped down as chief executive in August 2026 following criticism over the company's handling of safety complaints. The review, however, gave her credit for driving improvements from March 2026 onwards, and Travelodge has been credited with making changes since that point, though Greaney made clear that guests were still not as safe as they should be.

Travelodge responded to the findings by apologising "unreservedly" to the woman. The company's public apology marks the latest stage in a case that has already prompted scrutiny at the highest levels of government and widespread reporting on hotel security practices.

The political dimension intensified in March 2026 when then prime minister Sir Keir Starmer wrote directly to Boydell, urging her to "seriously engage" with the government over security matters. Greaney was appointed to lead the independent review the following month, a move intended to provide external scrutiny of the chain's practices.

Public reaction to the case was substantial. After the woman spoke to the BBC, dozens of people came forward to share their own experiences of strangers entering their hotel rooms. Among them was a domestic abuse victim whose abuser was given a key to her room at a Travelodge in London, a detail that reinforced concerns about how widely key-security failures extended.

The Maidenhead attack itself drew attention because of how quickly and easily it was carried out. Smith approached reception, made a false claim about his relationship to the victim, and was handed a key within minutes — a sequence of events that Greaney's review treats as evidence of organisational, not individual, breakdown.

For the victim, the review's conclusions confirm what she has argued since going public: that the failures were not confined to the night of the assault but continued through the complaint process. Being offered a modest refund after reporting a sexual assault, while her email sat unread by the chief executive for years, forms part of the pattern the review describes as failing her "at every stage."

The findings raise wider questions for the UK hotel industry. If room intrusions were being reported at close to one in 10 Travelodge properties during a single summer, the review suggests that key-handling and guest-safety protocols across budget hotel chains may warrant broader regulatory attention. The absence of any policy on violence against women and girls at Travelodge at the time of the review is likely to intensify calls for minimum security standards.

Travelodge now faces the task of demonstrating that the changes made since March 2026 are sufficient to prevent a repeat of the Maidenhead case. Greaney's assessment that guests remain less safe than they should be indicates that the company's work is far from complete, and the review's publication is likely to keep pressure on both the chain and the sector as a whole.

For the woman at the centre of the case, the review offers formal acknowledgement that she was failed repeatedly — by the staff who handed over a key without training, by a complaints system that routed her email to a manager she had criticised, and by a leadership structure that took more than three years to register her concerns. Whether that acknowledgement translates into durable change across Travelodge's hotels is now the central question.