In June 2015, an outbreak of cryptosporidiosis with 35 cases (23 probable and 12 laboratory-confirmed) occurred among 191 attendees of a residential rehabilitation holiday for paediatric organ transplant patients (n = 49) and their families at a hotel in Somogy county, Hungary. The overall attack rate was 18%. Most of the cases were transplanted children who experienced severe acute disease and required adjustment to their tacrolimus immunosuppression. A retrospective case-control study suggested an association between recreational water exposures and illness: cases were seven times more likely than controls to have swum in the children's pool (odds ratio 7.17; 95% confidence interval 2.9–17.2; P < 0.0001) and five times more likely to have used the jetted whirlpool (odds ratio 5.25; 95% confidence interval 2.1–13.1; P < 0.0001). This was the first outbreak of cryptosporidiosis in Hungary and it is especially unfortunate that it affected vulnerable children who experienced severe symptoms. Cryptosporidium presents specific infection control difficulties in treated recreational water venues; the link to a whirlpool is unusual and highlights the importance of the age-appropriate use of these facilities and reminding users not to immerse their heads or swallow the water. Cryptosporidiosis is more commonly linked to children’ pools where improved bather hygiene and promoting exclusion of diarrhoea cases could help to avoid similar outbreaks.