Personal data of 41,577 Dutch campers stolen in major European booking site hack
Thousands of Dutch vacationers became victims of a data breach at Secureholiday, a French online camping reservation system widely used across Europe. Data from 41,577 Dutch bookings was stolen, including names, email addresses, travel destinations, booking dates, and payment amounts, parent company Ctoutvert confirmed to the Dutch public broadcaster EenVandaag. That data was later used by the perpetrators in phishing scams.
The breach, discovered on Feb. 28, 2026, affected reservations at about 500 campgrounds, primarily in France, Spain, and Italy.
Cybercriminals later used the stolen information to send convincing phishing emails in May and June. The messages, which appeared to come from the campgrounds, referenced specific personal details such as booking dates and requested credit card payment confirmations. Some recipients grew suspicious of the payment demands and contacted the campgrounds directly to verify them.
Ctoutvert said it patched the security vulnerability the same day the issue was discovered. The company notified affected campgrounds so they could alert guests, since the campgrounds manage visitor data. However, many warnings reached campers only after they had already started questioning the suspicious emails. According to EenVandaag’s investigation, campers also shared warnings about the scam with each other on social media.
The Fraudehelpdesk, a Dutch fraud reporting organization, has received nearly 1,100 reports this year of similar phishing attempts via email, text messages, and apps.
"You can basically make everything look very realistic with the techniques that exist now," Eunice Bom from the Fraudehelpdesk told EenVandaag. "It is so almost impossible to distinguish from the real thing."
Reports spiked in January (220), May (285), and June (291)—periods when people typically pay for vacations. Bom advised people to always verify messages from accommodations before taking any action: "So be really alert to those kinds of messages and just don't respond to them. Really check if it's correct before you do anything."
Ctoutvert, which owns Secureholiday, operates in 18 countries, including the Netherlands, Germany, Belgium, France, Spain, the United Kingdom, and Denmark.
The system handles bookings for 4,300 campgrounds and processes about 1.2 million reservations annually. Campers are redirected from individual campground websites to Secureholiday to complete and pay for bookings.
In addition to the Dutch cases, many tens of thousands of other Europeans were affected. Fourteen campers have officially reported being scammed, including six Dutch. Ctoutvert said those victims are in contact with the relevant campgrounds and their banks.
The full scale of the breach remains unclear. Ctoutvert did not provide EenVandaag with an exact total number of victims but said half of the compromised bookings involved French customers.
"We are very concerned about the hack that we discovered on Feb. 28," Ctoutvert owner Manuel Mirabel told EenVandaag. The company filed a complaint with French authorities against the hackers. Ctoutvert also said it has implemented additional security measures and conducted an extra security review.
