Here is the complete intel brief article.
title: "Secureholiday: European Camping Booking Platform Breach and Phishing Campaign" date: 2026-07-15 slug: european-camping-booking-site-breach
Secureholiday: Data Breach Feeding a Targeted Phishing Campaign
Secureholiday, the French online camping reservation platform operated by Ctoutvert, suffered a data breach that exposed the personal booking data of 41,577 Dutch campers and likely many tens of thousands more across Europe. Parent company Ctoutvert confirmed the incident to Dutch public broadcaster EenVandaag. The breach was discovered on Feb. 28, 2026, and affected reservations at roughly 500 campgrounds, primarily in France, Spain, and Italy. Attackers later weaponized the stolen data into a convincing wave of phishing scams.
What Happened
Ctoutvert operates Secureholiday, a reservation and payment system that campers reach after being redirected from individual campground websites to complete and pay for bookings. The platform handles bookings for 4,300 campgrounds and processes about 1.2 million reservations annually across 18 countries, including the Netherlands, Germany, Belgium, France, Spain, the United Kingdom, and Denmark.
The company discovered the breach on Feb. 28, 2026, and says it patched the underlying security vulnerability the same day. Because the individual campgrounds manage their own visitor data, Ctoutvert notified the affected campgrounds so they could warn their guests rather than contacting victims directly. That indirect notification chain proved slow: many warnings reached campers only after they had already begun questioning the suspicious emails, and campers ended up sharing scam warnings with one another over social media before official alerts arrived.
What Was Taken
The stolen dataset covered 41,577 Dutch bookings and included names, email addresses, travel destinations, booking dates, and payment amounts. While the exposed records did not, per available reporting, include full payment card numbers, the combination of a real name, a real destination, real booking dates, and a real payment amount gave attackers everything needed to make follow-on fraud look authentic.
The Dutch figure is only a slice of the total. Ctoutvert indicated that many tens of thousands of additional records across other European markets were also affected, making this a pan-European exposure rather than a Netherlands-only event.
Why It Matters
This incident is a textbook example of how a single upstream platform breach cascades into fraud against thousands of downstream consumers who never interacted with the breached vendor by name. Campers booked through a campground website and were unaware their data lived in Secureholiday's systems, which complicated both notification and victim awareness.
It also demonstrates the value of context-rich data to phishing operators. Attackers did not need card numbers to succeed. Armed with legitimate booking details, they crafted messages that were, in the words of the Fraudehelpdesk, almost impossible to distinguish from the real thing. The Dutch Fraudehelpdesk has logged nearly 1,100 reports this year of similar phishing via email, text, and apps, with reporting spikes in January (220), May (285), and June (291) that align with seasonal vacation payment cycles.
The Attack Technique
The initial intrusion vector has not been publicly detailed beyond Ctoutvert's statement that it patched a security vulnerability the same day the breach was discovered, which points to an exploited flaw in the platform rather than the reporting confirming a specific technique.
The post-breach exploitation is well documented. In May and June, cybercriminals used the stolen records to send phishing emails that appeared to come from the campgrounds themselves. The messages referenced specific personal details, such as the recipient's actual booking dates, and requested confirmation of credit card payment. The realism came from data accuracy rather than technical spoofing sophistication. Some recipients grew suspicious specifically because of the payment demands and contacted their campgrounds directly to verify, which is what ultimately exposed the campaign.
What Organizations Should Do
- Treat third-party booking and payment intermediaries as in-scope for your own risk: inventory which vendors hold your customers' data, and confirm their breach-notification obligations flow through to you and your customers quickly.
- Establish direct, timely breach notification paths to affected individuals rather than relying on multi-hop chains through partners, which in this case let attackers reach victims before warnings did.
- Warn customers proactively that legitimate booking providers will not request credit card confirmation via email, and publish a known-good verification channel (a phone number on the official website) for guests to check suspicious messages.
- Minimize and segment stored booking data so that destinations, dates, and payment amounts are not retained longer than necessary, reducing the value of any future breach for phishing reuse.
- Monitor for lookalike domains and inbound messages impersonating your brand during peak payment seasons, and feed known scam templates to fraud-reporting bodies such as the Fraudehelpdesk.
- Advise customers to verify before acting: do not click links or confirm payments from unsolicited messages, and contact the accommodation directly using independently sourced contact details.
Sources: Personal data of 41,577 Dutch campers stolen in major European booking site hack | NL Times