Camping.Care booking system (TCS Camping): customer and booking data stolen in connection with the PHP flaws, with real reservation numbers already used in WhatsApp fraud and 15,000 guests warned as a precaution

TCS Camping is warning about 15,000 guests as a precaution because the provider of its booking system, Camping.Care, suffered a data theft; TCS confirmed to the SRF consumer programme Espresso on 2026-10-26 that fraudsters could steal customer and booking information, and SRF reports the case in connection with the worldwide PHP security hole (SRF, 2026-10-26). Blick describes Camping.Care as a Dutch company whose booking system handles reservations for all campsites of the Touring Club Schweiz, writes, citing SRF, that the hackers used the critical PHP flaw to steal customer and booking data and that Camping.Care is not the only software supplier hit (Blick, 2026-10-26). No source names the CVE identifiers, the entry point, the date of the intrusion or an actor, and TCS says the hole has since been closed (SRF, 2026-10-26). The stolen data already in criminal use includes, among other data, names, telephone numbers and reservation numbers: guests received fraudulent WhatsApp messages that refer to existing reservations (SRF, 2026-10-26). TCS says account details and IBANs were not affected and that credit card data is not stored in the booking system (SRF, 2026-10-26).

Triage: TCS Camping sends no automated booking details, payment requests or reservation links over WhatsApp, so a WhatsApp message of that kind that quotes a genuine reservation is the fraud, however accurate its details (SRF, 2026-10-26).