The online booking system of Miniatur Wunderland in Hamburg was targeted by cybercriminals, who managed to access payment transaction information. Investigations into the incident are ongoing.
A spokesperson for Miniatur Wunderland informed heise online that unknown attackers injected malicious code into a module of their online ticket booking system. Although no credit card data was stored locally, the attackers manipulated data traffic between the booking system's server and the payment service provider.
“Unknown individuals have inserted malicious code into a module of our online ticket booking system. No credit card data stored with us was stolen—we do not store any payment data locally.”
“According to the current status, the data traffic between our server and the payment service provider was manipulated, allowing the malicious code to read data during the payment process.”
“All systems were immediately cleaned after confirmation of the initial suspicion and replaced with completely new systems within 72 hours.”
This incident highlights the increasing risks cyberattacks pose even to well-established organizations using secure payment flows.
Author's summary: Miniatur Wunderland's booking system was compromised by a cyberattack that intercepted payment data without local storage breaches; swift action limited the damage and investigations continue.