Resolved -
In October 2026, guests of campsites that use Camping.care received WhatsApp messages from
criminals posing as their campsite. The messages contained real booking details and asked the
guest to make a payment. This shows that reservation data was taken from our platform.
Based on our investigation so far, we believe the data was taken by exploiting PHP2Shell, a newly
disclosed vulnerability in the PHP programming language that our platform runs on. We applied the
recommended mitigations at 15:58:51 CEST on 21 October, took our website offline at 16:00 CEST,
and have since installed the patched PHP versions. All systems run normally again. Our investigation
is ongoing and we will send an updated report.
Oct 23, 15:14 CEST
Update -
We are still investigating the WhatsApp phishing messages that guests have received. Here is where we are.
What happened
On 22 Oct 2026, between about 20:20 and 21:50, guests of Camping.care campsites received WhatsApp messages from the business account "Casagrand Builders" (an Indian number). The messages used real booking details and contained a phishing link. The links led to several look-alike domains, such as regvveclofn-todyobctre.com and todyclofn-regveocbtre.com.
What we have done so far
We rotated all database credentials and applied the latest security patches to our API servers.
We secured and extended the retention of all our logs so the investigation can be completed thoroughly.
We disabled several API functions as a precaution.
We temporarily took the guest page offline.
What we found We have gone through our application logs in detail. We found nothing suspicious there that explains the reservation details used in these messages. That points to a source outside our normal application traffic.
We are therefore focusing our investigation on two possibilities:
Unauthorized access to our database (e.g., a possible PHP web shell or other unauthorized access).
Someone obtaining the secure links (hashes) that give access to guest pages.
Because of the second possibility, the guest page remains unavailable until we have ruled it out or taken further measures. We know this affects your guests, and we will bring it back online as soon as it is safe.
Data we know the attackers had, for each reservation
The screenshots show these details in the messages:
Guest name
The guest's phone number, linked to that booking (the message reached that number and was about that booking)
Campsite name
Reservation number
Accommodation or pitch type
Arrival and departure dates
How you can help Please send us as many examples as you can, even if you think we already know about the case. Every example helps us narrow down the source. If possible, include:
A screenshot of the WhatsApp message, including the sender's phone number
The date and time the guest received it
The reservation number
Whether the booking confirmation was ever sent to the guest, and whether the reservation was recently created, changed, or deleted
Send your examples to support+phishing@camping.care.
Let us know directly if you receive reports of WhatsApp messages from reservations created after 21 October.
How many At least 37 reservations at about 30 campsites in the Netherlands, Germany, Belgium, Luxembourg, Switzerland, France, Spain, the UK, and Curaçao.
This only counts guests who reported it to a campsite and whose campsite then contacted us. The actual number is almost certainly higher.
What this tells us about the source
The data is recent.
It affects many campsites at once.
Stays from Oct 2026 to Sep 2027 were affected, so it involves future bookings, not only guests who are currently on site.
What we don't know yet
Email addresses, home addresses, prices, payment details: None of these appear in the messages we have seen. That only means they were not shown, not that they were not accessed.
Whether old records were included: Two reports do not fit the rest of the pattern.
Total impact: How many total reservations or campsites were affected.
Please keep advising your guests not to open the links in these messages and not to make any payments through them. We will post our next update as soon as we have more information.
Oct 23, 08:18 CEST
Identified -
We have a working theory about the root cause of this incident. Currently we are researching and validating this theory. We have taken several security measures for now. The guest page is currently not available due to the pending research.
Oct 23, 02:45 CEST
Update -
We are still investigating to get to the root cause of this problem. Currently we identified several leads to continue our investigation.
Oct 22, 23:30 CEST
Investigating -
We are currently investigating this issue. Please advise your customers not to open the link in the message.
Oct 22, 22:01 CEST
