We are still investigating the WhatsApp phishing messages that guests have received. Here is where we are.
What happened
On 22 Oct 2026, between about 20:20 and 21:50, guests of Camping.care campsites received WhatsApp messages from the business account "Casagrand Builders" (an Indian number). The messages used real booking details and contained a phishing link. The links led to several look-alike domains, such as regvveclofn-todyobctre.com and todyclofn-regveocbtre.com.
What we have done so far
We rotated all database credentials and applied the latest security patches to our API servers.
We secured and extended the retention of all our logs so the investigation can be completed thoroughly.
We disabled several API functions as a precaution.
We temporarily took the guest page offline.
What we found We have gone through our application logs in detail. We found nothing suspicious there that explains the reservation details used in these messages. That points to a source outside our normal application traffic.
We are therefore focusing our investigation on two possibilities:
Unauthorized access to our database (e.g., a possible PHP web shell or other unauthorized access).
Someone obtaining the secure links (hashes) that give access to guest pages.
Because of the second possibility, the guest page remains unavailable until we have ruled it out or taken further measures. We know this affects your guests, and we will bring it back online as soon as it is safe.
Data we know the attackers had, for each reservation
The screenshots show these details in the messages:
Guest name
The guest's phone number, linked to that booking (the message reached that number and was about that booking)
Campsite name
Reservation number
Accommodation or pitch type
Arrival and departure dates
How you can help Please send us as many examples as you can, even if you think we already know about the case. Every example helps us narrow down the source. If possible, include:
A screenshot of the WhatsApp message, including the sender's phone number
The date and time the guest received it
The reservation number
Whether the booking confirmation was ever sent to the guest, and whether the reservation was recently created, changed, or deleted
Let us know directly if you receive reports of WhatsApp messages from reservations created after 21 October.
How many At least 37 reservations at about 30 campsites in the Netherlands, Germany, Belgium, Luxembourg, Switzerland, France, Spain, the UK, and Curaçao.
This only counts guests who reported it to a campsite and whose campsite then contacted us. The actual number is almost certainly higher.
What this tells us about the source
The data is recent.
It affects many campsites at once.
Stays from Oct 2026 to Sep 2027 were affected, so it involves future bookings, not only guests who are currently on site.
What we don't know yet
Email addresses, home addresses, prices, payment details: None of these appear in the messages we have seen. That only means they were not shown, not that they were not accessed.
Whether old records were included: Two reports do not fit the rest of the pattern.
Total impact: How many total reservations or campsites were affected.
Please keep advising your guests not to open the links in these messages and not to make any payments through them. We will post our next update as soon as we have more information.
Posted Oct 23, 2026 - 08:18 CEST
Identified
We have a working theory about the root cause of this incident. Currently we are researching and validating this theory. We have taken several security measures for now. The guest page is currently not available due to the pending research.
Posted Oct 23, 2026 - 02:45 CEST
Update
We are still investigating to get to the root cause of this problem. Currently we identified several leads to continue our investigation.
Posted Oct 22, 2026 - 23:30 CEST
Investigating
We are currently investigating this issue. Please advise your customers not to open the link in the message.
Posted Oct 22, 2026 - 22:01 CEST
This incident affects: Starfish API, Backoffice, BookingEngine, Kiosk, and Payments.