Campingpark Kühlungsborn Data Breach Exposes Guest Details
A data breach at an external software provider has exposed personal and booking information for guests across 27 camping facilities, including the renowned Campingpark Kühlungsborn on the Baltic Sea coast. Attackers accessed names, postal addresses, phone numbers, email addresses, booking numbers, invoice amounts, and vehicle license plates through a guest portal vulnerability. The incident came to light on October 28, 2026, when the park notified visitors about suspicious WhatsApp messages attempting to extract payment and reservation confirmations.
The fraudulent messages arrive with genuine booking details, making them appear authentic to recipients. Criminals are using the leaked data to trick campers into following malicious links, entering payment details, and confirming reservations. The external software supplier has initiated steps to close the security gaps while investigations continue.
Fraudulent WhatsApp Messages Target Visitors
The compromised records have enabled targeted phishing operations against holidaymakers. The fraudsters contact customers via WhatsApp using exact stay information to create immediate credibility. The messages demand that guests verify their active bookings or submit confidential financial data.
Campingpark Kühlungsborn issued strict warnings against clicking links in unexpected messages or transferring funds under pressure. The park emphasized that all official administrative contact takes place strictly via email rather than through messaging apps like WhatsApp. Existing reservations remain fully valid, and guests do not need to repeat any booking procedures.
Steps Affected Guests Must Take Immediately
Individuals who have shared financial information on suspicious websites must contact their bank immediately to block affected cards. The centralized emergency blocking hotline is available around the clock at 116 116. Passwords and complete credit card numbers were not compromised in the initial data leak, according to the software provider’s assessment.
Guests uncertain about a message’s origin should reach out directly to the facility using verified contact details from original booking confirmations. Affected individuals retain rights under the General Data Protection Regulation to request information regarding stored personal data and can lodge complaints with data protection authorities.
Questions Unanswered Regarding the IT Service Provider
The total number of affected individuals and their identities remain unclarified by the park management. Neither the identity of the external software provider nor the names of the other 26 impacted camping facilities have been made public.
Keep reading