CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Camping.Care

product · product:camping-care single-source-victim

Coverage
1
first 2026-10-27 → last 2026-10-27
Latest activity
2026-10-27
TCS Camping warns 15,000 guests: supplier's booking data stolen, tied by SRF to the PHP flaws; WhatsApp fraud…
Peak priority
notable
1 notable
Targets
·
regions: switzerland, europe
Sources cited
3
3 hosts

Defender insights

What each entry about Camping.Care tells a defender to do, newest first.

2026-10-27NOTABLETCS Camping warns 15,000 guests: supplier's booking data stolen, tied by SRF to the PHP flaws; WhatsApp fraud under way

Exposure · triage · detection

Story timeline

  1. 2026-10-27Camping.Care booking system (TCS Camping): customer and booking data stolen in connection with the PHP flaws, with real reservation numbers already used in WhatsApp fraud and 15,000 guests warned as a precaution
    active-threatsTCS Camping warns 15,000 guests: supplier's booking data stolen, tied by SRF to the PHP flaws; WhatsApp fraud under way

Hunting pivots

Releases covered
Camping.Care
Tags
data-breachphishingsupply-chain
ATT&CK techniques (2 across 1 tactic)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application · Phishing: Spearphishing via Service

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-27/camping-care-tcs-camping-data-theft-php-flaw-whatsapp-fraud · ATT&CK page ↗

T1566.003Phishing: Spearphishing via Service×1

Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.

Evidence: 2026-10-27/camping-care-tcs-camping-data-theft-php-flaw-whatsapp-fraud · ATT&CK page ↗

Entries about Camping.Care (1)

2026-10-27 · view entry permalink →

NOTABLENATOB2

Camping.Care booking system (TCS Camping): customer and booking data stolen in connection with the PHP flaws, with real reservation numbers already used in WhatsApp fraud and 15,000 guests warned as a precaution

TCS Camping is warning about 15,000 guests as a precaution because the provider of its booking system, Camping.Care, suffered a data theft; TCS confirmed to the SRF consumer programme Espresso on 2026-10-26 that fraudsters could steal customer and booking information, and SRF reports the case in connection with the worldwide PHP security hole (SRF, 2026-10-26). Blick describes Camping.Care as a Dutch company whose booking system handles reservations for all campsites of the Touring Club Schweiz, writes, citing SRF, that the hackers used the critical PHP flaw to steal customer and booking data and that Camping.Care is not the only software supplier hit (Blick, 2026-10-26). No source names the CVE identifiers, the entry point, the date of the intrusion or an actor, and TCS says the hole has since been closed (SRF, 2026-10-26). The stolen data already in criminal use includes, among other data, names, telephone numbers and reservation numbers: guests received fraudulent WhatsApp messages that refer to existing reservations (SRF, 2026-10-26). TCS says account details and IBANs were not affected and that credit card data is not stored in the booking system (SRF, 2026-10-26).

Triage: TCS Camping sends no automated booking details, payment requests or reservation links over WhatsApp, so a WhatsApp message of that kind that quotes a genuine reservation is the fraud, however accurate its details (SRF, 2026-10-26).

As TCS confirms to the SRF consumer magazine Espresso, fraudsters were able to steal customer and booking information. (translated from German)

The security hole has meanwhile been closed. (translated from German)

SRF (Espresso) 2026-10-26

The hackers used the critical security hole in the PHP programming language to steal customer and booking data (translated from German)

Blick 2026-10-26

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the…

incident27 Oct 03:53Zsingle-source · victim disclosureOpen finding →
Sources: SRF (Espresso) · Blick · CISA (alert, updated 2026-10-26)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • blick.ch1 (33%)
  • cisa.gov1 (33%)
  • srf.ch1 (33%)
All cited sources (3)