The Touring Club Switzerland (TCS) has confirmed a theft of customer data from TCS Camping, its camping division, to the Keystone-ATS news agency and to the Espresso programme of Swiss German public broadcaster SRF. The data was stolen from Camping.care, the external provider that handles TCS Camping's bookings, in connection with the critical flaws in the PHP programming language. According to IT magazine ICTjournal, on 27 October 2026, some 15,000 customers were warned about scam attempts on the WhatsApp messaging service.
The scammers use genuine booking information to appear credible. According to the letter the TCS sent to its customers, quoted by ICTjournal and by the Swiss German website Inside IT, the fraudulent messages contain real names, phone numbers and booking numbers. Bank details and IBANs are not affected, according to the TCS.
WhatsApp scam: what TCS Camping customers should do
The most useful rule comes from the TCS itself: TCS Camping does not send automated booking details, links or payment requests via WhatsApp. Any such message claiming to come from TCS Camping is therefore suspicious, even if it mentions a real booking.
The TCS urges caution beyond this first wave. It warns that the stolen data may be used for further phishing attempts. Our analysis: three steps follow from these warnings.
- do not follow the link and do not pay anything in response to a WhatsApp message that mentions a TCS Camping booking;
- also be wary of calls, text messages or emails that quote a booking number: knowing that number does not prove the sender is the TCS;
- report the message to the Federal Office for Cybersecurity (NCSC), which receives voluntary reports of cyber incidents from the public, as 2clics noted in its article on the PHP2Shell PHP flaw.
The scenario is not new. On 20 October 2026, the NCSC described a scam linked to hotel bookings, which mainly targeted credit cards. In its new variants, the scammers also tried to take control of TWINT and e-banking accounts, as 2clics reported in an article on raising employee awareness of phishing.
TCS Camping is not the only one affected. According to ICTjournal, the Hüttenberg campsite in the canton of Thurgau is also warning on its website about fraudulent WhatsApp messages containing genuine booking information. Its operator assumes that booking data has been used without authorisation.
What is the link with the PHP2Shell flaw?
According to Inside IT, the PHP flaws had been made public the previous week. Dubbed PHP2Shell, they allow code to be executed on a web server without authentication. Listed as CVE-2026-109618 and CVE-2026-109619, they are rated 9.2 out of 10. Patches have been available since 21 October 2026, and the NCSC recommended installing them immediately.
The attackers did not wait for the patches. According to Bleeping Computer, an IT security news site cited by 2clics, exploitation attempts began four days before their release. On 22 October 2026, the company Risikomonitor counted just over 23,000 servers still exposed out of nearly 690,000 servers linked to Switzerland.
Our analysis: until now, 2clics' sources had not reported any successful intrusion in Switzerland. The TCS Camping case is the first Swiss data theft linked to the PHP flaws that 2clics has reported. According to the TCS, the flaw has since been fixed.
One provider attacked, several clients exposed
The pattern recalls the cyberattacks on pension funds. In both cases, it was a supplier's systems that were targeted, and not primarily those of the organisation whose customers are affected.
| Organisation affected | Provider attacked | Data involved according to sources |
|---|---|---|
| TCS Camping and Hüttenberg campsite | Camping.care, bookings | According to the TCS: names, phone numbers, booking numbers; no IBANs |
| Pension fund of the City of Zurich | Unnamed software supplier | In the worst case: contact details, social security number, IBAN, pension data |
| Federal pension fund Publica, Bernese Pension Fund (BPK), Bernese Teachers' Pension Fund (BLVK) | PK Softech, pension fund software | Not yet established; Commissioner's investigation under way |
The Zurich case, reported on 16 October 2026 in the article on the Zurich pension fund, could affect far more sensitive data. In the case of PK Softech, the Federal Data Protection and Information Commissioner (FDPIC) opened an investigation into PK Softech on 23 October 2026. He wants to establish which data the pension funds had entrusted to the provider.
Data breach: what the Swiss framework provides
In Switzerland, two federal points of contact receive reports, with distinct roles. The Commissioner deals with the protection of personal data. The NCSC handles the incident from a technical perspective. For an SME, reporting to the NCSC remains voluntary; only operators of critical infrastructure have been required to do so since 1 April 2025.
Reports to the Commissioner are rising. The office holder, Adrian Lobsiger, has received 455 reports of data security breaches since the start of 2026, compared with 343 for the whole of 2025. He said so on 25 October 2026, adding that many data breaches in Switzerland never reach him.
Previous cases show how it works in practice. PK Softech itself reported the attack to the Commissioner on 8 October 2026, and the online magazine Republik notified him of the theft of its users' data. The sources consulted do not detail the criteria or the deadline set by the Federal Act on Data Protection (FADP) for such a report.
For an SME that entrusts its bookings or customer database to a provider, two pieces of advice emerge from 2clics' sources: ask the supplier whether it has applied the PHP2Shell patch, and pass on only the data that is strictly necessary, as the Commissioner recommends.
What we do not know yet
- The number of customers whose data was actually stolen: the 15,000 customers were warned as a precaution, according to ICTjournal.
- The date of the intrusion at Camping.care and the exact flaw used.
- The number of other campsites, in Switzerland or elsewhere, that work with Camping.care and could be affected.
- Whether the TCS or Camping.care reported the incident to the Commissioner or to the NCSC: the sources consulted do not say.
- The identity of the authors of the WhatsApp messages.
