Caravan and Motorhome Club

Summary

The Caravan and Motorhome Club experienced a cybersecurity incident, prompting immediate system shutdowns, forensic investigation, and regulatory notification. Service disruptions affected online bookings, insurance processing, and website access, though physical campsites remained operational; contact center functionality was partially restored during recovery. The organization is investigating potential unauthorized data access while advising members on security precautions.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The Caravan and Motorhome Club detected a cybersecurity incident on January 20, 2024, when external forensic experts alerted the organization to unauthorized activity. Immediate containment protocols were activated, including taking all digital systems offline and deploying enhanced monitoring tools to limit further compromise. The Club notified the UK Information Commissioner's Office (ICO) on the same day as part of standard breach reporting procedures. Initial communication with members was deliberately withheld on cybersecurity advisors' recommendations to prevent alerting attackers during the forensic investigation phase. This decision resulted in member frustration due to inaccessible digital services and contact centers during the initial outage period. Director General Nick Lomas later confirmed the incident via website update, acknowledging the communication challenges while emphasizing containment success through rapid system isolation.

System impacts included complete website unavailability, disabled online booking systems, and temporary contact center inaccessibility. UK Club campsites, Affiliated Campsites, and Certificated Locations remained operational throughout the incident, accepting direct phone bookings. Partial service restoration began January 29 with contact center reactivation for UK campsite bookings and overseas booking modifications. Membership enrollment shifted exclusively to phone transactions due to website downtime. Critical insurance services (Caravan Cover, Motorhome Insurance, Red Pennant, Mayday) experienced phased reactivation under continued IT monitoring. Forensic investigators worked to determine potential unauthorized data access or exfiltration, with findings pending at the time of reporting. The Club committed to direct member notifications if personal data compromise was confirmed. IT recovery efforts prioritized gradual system restoration with external cybersecurity partners, emphasizing security validation over operational speed. Member advisories included password resets and phishing vigilance, though no confirmed data misuse was reported during the incident timeline documented in the update.

Sources

Sources available to members: 1 source.