Luxury camping providers Roan and Eurocamp have disclosed a data breach, affecting thousands of tourists.

The breach was discovered on March 17th, following reports to their customer service. At the time, the breach appeared only to affect guests whose stays were scheduled to begin in March.

However, on March 25th, the camping provider’s third-party technology supplier confirmed that the incident affected a much larger group of guests.

“Upon discovering the issue, we immediately activated a multidisciplinary crisis management team. We worked urgently with our external technology provider to conduct a forensic analysis and patch the vulnerability. At the same time, we secured our own systems by resetting passwords on partner platforms and verifying multi-factor authentication (MFA) at all critical access points,” Roan and Eurocamp say.

According to the campground operators, the vulnerability has been patched, and data protection authorities have been notified of the incident.

The attackers managed to steal personal information of an undisclosed number of victims, including full names, email addresses, phone numbers, holiday destinations, travel data, and travel prices.

Roan and Eurocamp assure that no passwords, financial information, or home addresses have been exfiltrated.

The operators state that affected customers aren’t entitled to financial compensation.

“Since no financial information, passwords, or sensitive personal data was compromised, and since a prompt alert was issued to prevent any actual financial loss, we will not be offering financial compensation for this incident. Our focus remains on the immediate security of your account and the integrity of our systems,” they say.

Some victims have received a payment link via WhatsApp, indicating that the stolen data is being actively exploited. Therefore, the camping providers recommend being vigilant for suspicious messages. The companies emphasize that they will never send payment links directly via WhatsApp or text message.

In October 2025, Dutch travel agency Sunweb Group confirmed that “an unauthorized party” stole personal details of an undisclosed number of clients. This data was also exploited to trick customers into transferring money to the attackers’ bank account.

---

Unlock more exclusive Cybernews content on YouTube.