Major IT outage at Europe's largest caravan and RV club makes for not-so-happy campers
(2024/01/24)
- Reference: 1706117411
- News link: https://www.theregister.co.uk/2024/01/24/major_it_outage_at_caravan/
- Source link:
The UK's Caravan and Motorhome Club (CAMC) is battling a suspected cyberattack with members reporting widespread IT outages for the past five days.
The company, which describes itself as "Europe's biggest touring community, helping caravanners, motorhomers and campers access over 3,000 stunning locations in the UK and Europe", has alerted the UK's Information Commissioner's Office (ICO) to its situation, suggesting it has suffered a meaningful data security incident.
UK organizations must notify the ICO within 72 hours if they suffer a breach that's likely to risk people's rights and freedoms. The data watchdog confirmed to us today that it's investigating based on the information provided to it.
[1]
CAMC's issues reportedly began on January 20 when its website and mobile app originally went down "for maintenance" but have since refreshed to communicate that external teams are involved in bringing its systems back to working order.
[2]
[3]
Multiple CAMC members approached The Register to complain about the outages, which according to their accounts have caused near-total digital disruption at the company that represents 1 million members.
One member said they've been unable to book a March holiday over the phone due to the disruptions with booking systems. When asked whether the disruption was caused by a cyberattack, or if member data had been compromised, customer service staff were said to be unaware of the specifics.
[4]
Others expressed concern over the possibility that data indicating when they'd be on holiday, coupled with their home addresses, could have been leaked.
Over on Facebook, one techie [5]complained : "After 25 years in IT the only way to have people's understanding and patience is to keep them informed. Posting the same status reworded does nothing to settle the users. Much easier to say we accidently applied an update or a resource deleted a database..."
Members have also expressed annoyance with the CAMC for not communicating directly with members over email or phone.
[6]
"Oh dear, I wonder if it's [a] [7]ransomware -related security breach," one member jibed on social media today, echoing similar posts. "Certainly think members are entitled to know more about the nature of the problem and any data compromise or leakage. It's been too long an outage without any real update."
[8]The price of freedom turned out to be an afternoon of tech panic
[9]Sounds like the black helicopters have come for us. Oh, just another swarm of FAA-approved Amazon delivery drones
[10]Mirror mirror on sea wall, spot those airships, make Kaiser bawl
[11]Cybercrooks book a stay in hotel email inboxes to trick staff into spilling credentials
Official comms related to the incident have come via the CAMC's social media channels, with the most recent line being repeated to angry members: "Our technical teams are still investigating the source of the issue, we have been advised there is no evidence that member data was compromised."
Reading between the lines, the fact that the CAMC specified no member data was affected, combined with the fact it reported itself to the ICO, suggests that other data could have been compromised.
While the CAMC has thus far avoided using the dreaded C word, cases involving widespread service outages that affect multiple platforms, and ones that require outside experts to restore access to systems, often eventually result in a cyberattack being blamed.
The incident could feasibly be explained by other possibilities too, although in cases where cybercriminals aren't involved, we would expect the company to quickly explain that to be the case.
The CAMC has not responded to our contact attempts, and neither has the National Crime Agency (NCA), which is often called upon to deal with cybersecurity incidents in the UK.
Another member of the camping club got in touch to say the CAMC's website and booking system "has been a shambles" since it was redesigned by digital transformation agency Freestyle Interactive, which also failed to respond to our contact requests.
It's unclear the role Freestyle Interactive still has in the running of the CAMC's digital infrastructure, although its website describes the agency's partnership with the CAMC as "ongoing."
The CAMC's website currently reads: "We sincerely apologize that members and guests are still unable to access any of our digital channels.
"Our partners and external teams of specialists are working hard to help bring our systems back online.
"We would ask for your continued support and patience and again offer our apologies for any inconvenience this is causing."
While phone systems are back offline after a brief outage at the start of the affair, members have been asked to avoid calling "unless it's an urgent matter," a customer support message read on its Facebook page.
Judging by social media posts made by the CAMC's subsidiaries, it appears the outage is contained to the CAMC only, as bookings are still being taken over the phone, online, and via email at multiple partnered travel businesses. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZbGWn17pPAZMXQUlFYVfwwAAAco&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZbGWn17pPAZMXQUlFYVfwwAAAco&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZbGWn17pPAZMXQUlFYVfwwAAAco&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZbGWn17pPAZMXQUlFYVfwwAAAco&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.facebook.com/candmclub/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZbGWn17pPAZMXQUlFYVfwwAAAco&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2024/01/18/ransomware_attacks_hospitalize_security_pros/
[8] https://www.theregister.com/2023/08/14/who_me/
[9] https://www.theregister.com/2020/09/01/amazon_prime_drones/
[10] https://www.theregister.com/2018/05/31/geeks_guide_to_britain_sound_mirrors_north_east/
[11] https://www.theregister.com/2023/12/20/hotel_cybercrime_research/
[12] https://whitepapers.theregister.com/
The company, which describes itself as "Europe's biggest touring community, helping caravanners, motorhomers and campers access over 3,000 stunning locations in the UK and Europe", has alerted the UK's Information Commissioner's Office (ICO) to its situation, suggesting it has suffered a meaningful data security incident.
UK organizations must notify the ICO within 72 hours if they suffer a breach that's likely to risk people's rights and freedoms. The data watchdog confirmed to us today that it's investigating based on the information provided to it.
[1]
CAMC's issues reportedly began on January 20 when its website and mobile app originally went down "for maintenance" but have since refreshed to communicate that external teams are involved in bringing its systems back to working order.
[2]
[3]
Multiple CAMC members approached The Register to complain about the outages, which according to their accounts have caused near-total digital disruption at the company that represents 1 million members.
One member said they've been unable to book a March holiday over the phone due to the disruptions with booking systems. When asked whether the disruption was caused by a cyberattack, or if member data had been compromised, customer service staff were said to be unaware of the specifics.
[4]
Others expressed concern over the possibility that data indicating when they'd be on holiday, coupled with their home addresses, could have been leaked.
Over on Facebook, one techie [5]complained : "After 25 years in IT the only way to have people's understanding and patience is to keep them informed. Posting the same status reworded does nothing to settle the users. Much easier to say we accidently applied an update or a resource deleted a database..."
Members have also expressed annoyance with the CAMC for not communicating directly with members over email or phone.
[6]
"Oh dear, I wonder if it's [a] [7]ransomware -related security breach," one member jibed on social media today, echoing similar posts. "Certainly think members are entitled to know more about the nature of the problem and any data compromise or leakage. It's been too long an outage without any real update."
[8]The price of freedom turned out to be an afternoon of tech panic
[9]Sounds like the black helicopters have come for us. Oh, just another swarm of FAA-approved Amazon delivery drones
[10]Mirror mirror on sea wall, spot those airships, make Kaiser bawl
[11]Cybercrooks book a stay in hotel email inboxes to trick staff into spilling credentials
Official comms related to the incident have come via the CAMC's social media channels, with the most recent line being repeated to angry members: "Our technical teams are still investigating the source of the issue, we have been advised there is no evidence that member data was compromised."
Reading between the lines, the fact that the CAMC specified no member data was affected, combined with the fact it reported itself to the ICO, suggests that other data could have been compromised.
While the CAMC has thus far avoided using the dreaded C word, cases involving widespread service outages that affect multiple platforms, and ones that require outside experts to restore access to systems, often eventually result in a cyberattack being blamed.
The incident could feasibly be explained by other possibilities too, although in cases where cybercriminals aren't involved, we would expect the company to quickly explain that to be the case.
The CAMC has not responded to our contact attempts, and neither has the National Crime Agency (NCA), which is often called upon to deal with cybersecurity incidents in the UK.
Another member of the camping club got in touch to say the CAMC's website and booking system "has been a shambles" since it was redesigned by digital transformation agency Freestyle Interactive, which also failed to respond to our contact requests.
It's unclear the role Freestyle Interactive still has in the running of the CAMC's digital infrastructure, although its website describes the agency's partnership with the CAMC as "ongoing."
The CAMC's website currently reads: "We sincerely apologize that members and guests are still unable to access any of our digital channels.
"Our partners and external teams of specialists are working hard to help bring our systems back online.
"We would ask for your continued support and patience and again offer our apologies for any inconvenience this is causing."
While phone systems are back offline after a brief outage at the start of the affair, members have been asked to avoid calling "unless it's an urgent matter," a customer support message read on its Facebook page.
Judging by social media posts made by the CAMC's subsidiaries, it appears the outage is contained to the CAMC only, as bookings are still being taken over the phone, online, and via email at multiple partnered travel businesses. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZbGWn17pPAZMXQUlFYVfwwAAAco&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZbGWn17pPAZMXQUlFYVfwwAAAco&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZbGWn17pPAZMXQUlFYVfwwAAAco&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZbGWn17pPAZMXQUlFYVfwwAAAco&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.facebook.com/candmclub/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZbGWn17pPAZMXQUlFYVfwwAAAco&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2024/01/18/ransomware_attacks_hospitalize_security_pros/
[8] https://www.theregister.com/2023/08/14/who_me/
[9] https://www.theregister.com/2020/09/01/amazon_prime_drones/
[10] https://www.theregister.com/2018/05/31/geeks_guide_to_britain_sound_mirrors_north_east/
[11] https://www.theregister.com/2023/12/20/hotel_cybercrime_research/
[12] https://whitepapers.theregister.com/
Doctor Syntax
"the only way to have people's understanding and patience is to keep them informed."
This is not standard practice. Standard practice is simply to thank them for their patience irrespective of the fact that they are actually fuming with being kept in the dark.
Doctor Syntax
"the dreaded C word"
Caravan?
abend0c4
"Communal"
As in latrines, shower blocks, laundries, swimming and food preparation.
Or, equally, the specific, domestically familiar brands of Cornflakes, corned beef and corn plasters which seem the caravans' principal contents and main cause for continuance.
What does CAMC run on
t245t
Netblock owner -------------------------------- IP address --- OS ----- Web server -------- Last seen
FTIP003367322 The Caravan Club Ltd .. 62.6.174.68 .. Linux .. Microsoft-IIS/6.0 .. 14-Apr-2014
Should have gone Dutch
[1]Dutch legend has been running his campsite since 1986 using an Atari ST
Nobody's getting past his custom software and air-gaped security.
[1] https://www.pcgamer.com/dutch-legend-has-been-running-his-campsite-since-1986-using-an-atari-st/