Data protection incident at partner company

The security of your data is our top priority. We are contacting you today with important information regarding a security incident at our external IT service provider for our voucher online shop, INCERT eTourismus GmbH & Co KG.

What happened?
Between November 2nd and 5th, 2026, unknown attackers gained unauthorized access to the systems of our service provider, INCERT. According to the current stage of the investigation, this resulted in a data leak involving customer information. As soon as the vulnerability was discovered, it was immediately closed on November 5th, 2026, and additional security barriers were established. The relevant data protection authorities have already been notified.

Which data is affected?
The unauthorized access potentially affects data of individuals who purchased vouchers through our online shop. This includes:

• First and last names
• Email addresses and phone numbers
• Postal addresses and, if applicable, dates of birth
• Order details and specific voucher codes

⚠️ Important All-Clear: Your banking details, credit card information, or passwords are not affected, as this sensitive payment information was never stored in the system of the impacted voucher shop.

IMPORTANT WARNING: How to protect yourself against scam attempts

Criminals often use stolen order details for highly realistic scam attempts via email, SMS, or phone calls (known as phishing or spear phishing). Because the perpetrators know your actual purchase details, these messages can appear exceptionally trustworthy.

Please observe the following safety rules to protect yourself:

1. Critically verify all communications: Be suspicious of unsolicited messages referring to your voucher purchase or requiring urgent action (e.g., alleged verifications, payment issues, or subsequent invoices).
2. Do not click on links: Do not open links or file attachments in emails or SMS messages unless you can verify the sender beyond any doubt. When in doubt, always access our official website directly through your browser.
3. Never share passwords or payment data: We will never ask you for your passwords, PINs, or credit card details via email, phone, or SMS, nor will we request payments through these channels.
4. Watch out for identity theft: Monitor your bank account movements and check if you receive unexpected reminders, invoices, or order confirmations for items you never ordered.

We deeply regret this incident and sincerely apologize for any inconvenience caused. Together with our service provider and the investigative authorities, we are doing everything in our power to fully resolve this matter.

Should you have any questions or wish to report a suspicious message, our customer service team is available at any time at +43 6542 789 0 or via email at datenschutz@schmitten.at .

If youwant more Details directly from INCERT eTourismus GmbH & Co KG please visit their Info Page.