Slovenia Tourism Hits Record Highs in the First Half of 2026


La Slovénie poursuit sa dynamique touristique en 2026 - Depositphotos.com @ DaLiu

Hurtigruten


Slovenia continues its tourism momentum in 2026.

Nearly 3 million arrivals were recorded in the first half of the year, up by 5 % year on year, while overnight stays grew by 5.7 %, surpassing 7 million, according to data from the Statistical Office of the Republic of Slovenia (SURS).

The international clientele now accounts for 71 % of overnight stays, with more than 5.2 million overnights between January and June, up 6.8 % compared with the same period in 2025.

The Germany, Italy and Austria are the main sending markets. Ljubljana, Piran and Bled, for their part, are among the country’s most visited towns.


Slovenia: June, record month for the destination

The growth notably accelerated in the spring. June 2026 became the best month ever recorded in Slovenia, with for the first time more than 2 million overnight stays in a single month.

This performance fits into a broader trend of extending the tourist season. After an increase in overnight stays of 12 % in May–June, 11 % in September and 10 % in October last year, the momentum continues in 2026.

The May and June months thus show a cumulative rise of 5.4 % in overnight stays year on year.

The structure of demand is also shifting. While the domestic market accounted for 44.4 % of overnight stays in February, its share fell to 21.4 % in May and 22.7 % in June.

Meanwhile, the international markets advanced throughout the period, up to representing 47.3 % of overnight stays in June.


The mountains record the strongest growth

Among the various categories of Slovenian destinations, mountain municipalities show the largest growth.

They registered 2.1 million overnight stays in the first half of the year, representing 29 % of the national total and a rise of 11 % compared to the first half of 2025. Bled, Bohinj and Kranjska Gora rank among the most visited destinations.

The trend was particularly confirmed in June, with nearly 731,000 overnight stays in mountain municipalities, i.e., 37 % of all overnight stays recorded in the country during the month.

The other destination categories also posted positive results. Spa towns generated 1.6 million overnight stays in the first six months of the year (+3.4 %), ahead of Ljubljana (1.2 million, +5.7 %) and the coast (1.2 million, +1.4 %). Urban municipalities recorded 500,000 overnight stays (+4.5 %).

The rise of the mountains comes as these areas already accounted for 31 % of national overnight stays in 2025, with 5.5 million overnight stays across the year.


Stable French visitation

On the French market, the momentum appears more stable. Between January and August 2026, Slovenia welcomed 187,532 French tourists, for a total of 449,190 overnight stays. These results remain relatively close to those recorded the previous year.

The Slovenian domestic market, for its part, generated more than 2.1 million overnight stays in the first half, up 2.8 %. Piran, Kranjska Gora and Brežice appear among its preferred destinations.

In terms of profiles, the 35–44 years age group constitutes the main bracket among tourists, while visitors aged 65 and over generate the largest number of overnight stays.


1.17 billion euros in tourism receipts

The solid attendance is also reflected in revenues. Between January and May 2026, the value of Slovenian tourism exports reached 1.17 billion euros, according to data from the Bank of Slovenia, up 6.2 % year on year.

These results reinforce the country’s strategy to better distribute tourist flows across space and over the year, while developing a model described as more sustainable.

The rise of mountain destinations occurs within a context of travel habit transformation, notably under the influence of climate change.

Like other European destinations, Slovenia aims to capitalize on the growing interest in the ‘coolcation’, which involves preferring destinations offering greater coolness in the summer period, as well as experiences oriented towards nature.

On a relatively small territory, the destination concentrates several types of landscapes and activities: the Alps, lakes, rivers, forests, thermal waters, karst landscapes, countryside and coastline.


Atout France Has Been Hacked: Cyberattack Hits French Tourism Agency


ttt

tttt
Atout France dans la lignée de Belambra, Maeva et Gîtes de France - Depositphotos retouchée par l'IA
ttt

ttt

t

tt

CroisiEurope


tt

tt

tt

tt

ttt

tttt The list is long and shows no signs of stopping.
tttt
tttt
tttt After the historic wave of hacks that hit tourism in May, revealing a relatively basic vulnerability among several major players in the sector, cyberattacks continue in the tourism industry, without ever stopping.
tttt
tttt
tttt And this time, it is the turn of a public institution to have its vulnerabilities laid bare.
tttt
tttt
tttt Atout France therefore suffered an attack by a malicious individual who could have extracted, according to their statements, data from approximately 400,000 user accounts.
tttt
tttt
tttt Samples, as a gesture of good faith, as is customary on the dark web, have been shared.
ttt

tt

tt

t

ttt

ttt

Atout France Following in the Footsteps of Belambra, Maeva, and Gîtes de France

tt

tt

ttt

tttt The hacker claims to have exploited an access-control flaw, i.e., an IDOR (Insecure Direct Object Reference) vulnerability, according to frenchbreaches, as was the case for Belambra, Gîtes de France or Maeva.
tttt
tttt
tttt “In French, one could translate that as having a direct reference to an unsecured object.
tttt
tttt
tttt That is to say that if a profile, a file or an invoice is stored directly within an application, simply entering the direct address could allow access, even without the proper authorization.
tttt
tttt
tttt We are not facing an extraordinarily sophisticated technical exploit, but rather a misunderstanding of security at the human level,
” we were told by Christophe Mazzola, founder of the Cyber Academy, in a previous article.
tttt
tttt
tttt Beyond this weakness, the consequences can be dire for companies or individuals.
tttt
tttt
tttt Regarding Atout France, about 400,000 user accounts would thus be compromised. The attacker(s) would have access to names, first names, roles, emails, phone numbers, billing postal addresses, organizations, member numbers…
tttt
tttt
tttt A multitude of information that could feed, in the future, phishing campaigns or other highly targeted malicious actions. Vigilance will therefore need to be doubled in case of emails purportedly sent by Atout France in the days and months to come.
ttt

tt

tt

t

ttt

ttt

Pacha Tours and Trenitalia France Also Hacked

tt

tt

ttt

tttt Do not believe that, after the historic wave of hacks that the tourism industry experienced, hackers have lost interest in the sector; quite the opposite.
tttt
tttt
tttt Taking advantage, no doubt, of the sector’s cybersecurity weaknesses, the trophies have been many.
tttt
tttt
tttt There was, at the end of June, Pacha Tours. The hackers claimed to have extracted 2 GB of data thanks to “a code-injection technique used to modify or retrieve data in SQL databases (tables with rows and columns, ndlr)“, according to Cloudflare.
tttt
tttt
tttt Thus, on both the Pacha Tours site and its pro space, the compromised data would concern 31,087 unique individuals, 4,413 unique emails, 3,705 unique phones, 132 cleartext passport numbers, 10,153 PNR codes, and 1,096 B2B agency accesses with passwords in clear text, according to the attackers.
tttt
tttt
tttt But that’s not all, because Trenitalia France also suffered a similar misfortune.
tttt
tttt
tttt The malicious actors gained unauthorized access to certain personal data of customers related to ticket purchases. This attack has been confirmed by the operator.
tttt
tttt
tttt An email campaign was sent to the company’s customers.
tttt
tttt
tttt It reveals that the information in the pirates’ possession includes: civil and identification data (buyer and passenger names, passenger date of birth); contact data (email address, phone number); travel data (information associated with the transport ticket, such as itinerary, travel date and time, ticket number); type of offer or service linked to the transport ticket and data needed to benefit from these offers.
tttt
tttt
tttt Moreover, the attackers claim to have extracted data from 60,568 user accounts, as well as metadata from Smartbox agreements or e-signature documents.
tttt
tttt
tttt “We really need to roll up our sleeves and get to work, because this kind of data leak, in Europe, we are truly among the few who know this story.
tttt
tttt
tttt I work a lot in the United Kingdom, Germany, the Netherlands, Luxembourg, Switzerland and Belgium; there, this isn’t as common. France is acting as the delinquent student,
” Christophe Mazzola explained to us.
ttt

tt

tt

t