For: people registered as internet members in Club Tourism's internet reservation system (anyone who made a web member account to book trips); people listed as someone's emergency contact may also be involved. This article is based on the company's official notice and does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people registered as internet members in Club Tourism's internet reservation system (anyone who made a web member account to book trips); people listed as someone's emergency contact may also be involved.
- Confirmed so farSee the table ↓
- Unauthorized access
- Count
Listed as possibly affected
- Name (kanji/kana), nationality, sex, date of birth, age, address, phone, email, member ID, emergency contact
- Whether data was taken
- Not yet confirmed
- Details of how the intrusion happened and the cause
- Whether the data was actually taken (the notice says it may have leaked)
- When individual notices will reach affected people
2 more
- When the website, My Page and other services will resume
- Whether any misuse occurs
- What to do nowSee the steps ↓
- Know how to tell if you may be affected
- Check anything claiming to be from the company without using its links or numbers
- Check whether you reused a password
2 more
- Tell the people you listed as emergency contacts
- Use only the contact in the notice
- Where to verify (source)All sources ↓
- Club Tourism Co., Ltd., "Apology and notice regarding personal information leakage due to unauthorized access (First Report)" (October 31, 2026; checked November 1; Japanese)
- Last checked
- As of November 1, 2026
Follow-up plans and what we checked
The company calls its October 31 notice the "First Report" and says it covers the facts known so far. It says it will contact people whose information may have leaked in turn and continue investigating with the help of investigation and related bodies. On November 1 we checked the notice page and the company's travel site and found no Second Report. The travel site said it was under system maintenance and that My Page, credit card payment and the checking of documents for web applications were unavailable.
What members should do
Know how to tell if you may be affected
According to the notice, the scope is the information of people registered as internet members in the internet reservation system. People who have never registered as internet members are not affected. The company says it will contact people whose information may have leaked in turn.
If you have ever registered a web member account, assume you may be affected and prepare while you wait to hear from the company.
Check anything claiming to be from the company without using its links or numbers
Name, address, phone number, email address and member ID are all material for a convincing fake. If a call, email or text arrives about a "tour payment refund", a "tour change or cancellation", "confirming your member information" or an "apology", do not use the link or the phone number in it. Check on the official site you opened yourself, at a branch, or through the contact in the notice.
The company says that in connection with this incident it will never ask, by phone, email, SMS or post, for credit card numbers, bank account information, PINs, IDs and passwords, or My Number. Do not open suspicious URLs, do not open attachments, and do not enter personal or authentication information.
Check whether you reused a password
The company says login passwords are not included. It still asks people who use the same password as for its service on other services to consider changing it as a precaution.
- Change to a password different from your other services and hard to guess (How to check if your password was leaked)
- Turn on multi-factor authentication where you can
Tell the people you listed as emergency contacts
Emergency contact is one of the affected items, and the notice does not say what it contains. If you registered family members, tell them to be careful with messages claiming to be from the company or a travel agency (this site's advice).
Use only the contact in the notice
The company has set up a dedicated customer line: toll-free 0120-335-255, open on weekdays (Monday to Friday) 9:30 to 17:00, and in November also on Saturdays, Sundays and holidays at the same hours. It is the contact for suspicious messages claiming to be from the company, and for damage or anything unusual you think is related to this incident.
1. Call / email / SMS claiming to be Club Tourism
Name, address, member ID are correct → do not decide here
↓
2. Skip the links and numbers; check on the official site, at a branch, or via the notice's contact
↓
3-A Nothing on the official side
Asks for card numbers, PINs, passwords → do not comply
3-B The official side shows the same notice
Follow the official instructions
What happened (according to Club Tourism)
This section is based on the company's notice "Apology and notice regarding personal information leakage due to unauthorized access (First Report)" of October 31, 2026, and the message on its travel site (checked November 1).
October 30, 2026, 5:45
Unauthorized access from outside detected. Investigation began; communication to the affected part was cut and necessary security measures were takenOctober 30
Investigation confirmed that part of the customer information it holds may have leaked outside (the date given in the notice)October 31
First Report published. It says it consulted the police and reported to the Personal Information Protection Commission and its supervising authorityNovember 1
The travel site said it was under system maintenance, with My Page, credit card payment and checking of documents for web applications unavailable (checked by this site)
- Affected information
- Name (kanji and kana), nationality, sex, date of birth and age, address, phone number, email address, member ID and emergency contact of people registered as internet members in the internet reservation system. About 4.32 million records
- Not included
- Login passwords, passport information, credit card information, bank account numbers. People who have never registered as internet members are not affected
- Company response
- Isolated the affected server and cut communication from the source. Identified the intrusion route and method and carried out corrective work, including fixing problems and checking the scope and for similar events. The website is stopped to prevent further damage and investigate, and will resume once safety is confirmed
- Secondary damage
- No specific secondary damage attributed to this incident has been confirmed so far
- Next steps
- Contact people whose information may have leaked in turn. Police consulted; the Personal Information Protection Commission and supervising authority informed. Investigation continues with the help of investigation and related bodies
For the company's holding company, KNT-CT Holdings Co., Ltd., we checked its IR news list for 2026 on November 1 and found no disclosure on this incident (the latest entry was a monthly sales report on October 9). The notice page links to the holding company's site.
What is known and what is not
This is the state as of November 1, 2026. We will rewrite this table as updates appear.
| Item | What the company said | Status |
|---|---|---|
| Unauthorized access | Detected 5:45 on October 30, 2026; unauthorized access from outside to part of its servers | Confirmed (company) |
| Name (kanji/kana), nationality, sex, date of birth, age, address, phone, email, member ID, emergency contact | Internet members' information in the internet reservation system may have leaked outside; about 4.32 million records | Possible (company) |
| Login passwords | Not included | Not included (company) |
| Passport information | Not included | Not included (company) |
| Credit card information | Not included (the travel site has stopped card payment) | Not included (company) |
| Bank account numbers | Not included | Not included (company) |
| People who are not internet members | Not affected | Not included (company) |
| Count | About 4.32 million; the notice says "records", not people | Confirmed (company, First Report) |
| Cause and route | Route and method identified and fixed; specifics not given | Under investigation |
| Whether data was taken | Says "may have leaked"; does not say removal was confirmed | Possible (company) |
| Misuse / secondary damage | No specific secondary damage confirmed so far | Not confirmed (company) |
| Contact with affected people | Will contact people whose information may have leaked in turn | Under investigation (timing not published) |
| Regulators | The company says it consulted the police and reported to the Personal Information Protection Commission and its supervising authority. We found no statement from the authorities | Not stated (authorities) |
| Holding company disclosure | No entry in KNT-CT Holdings' IR news (checked November 1) | Not stated |
How to read this: "may have leaked" and "4.32 million records"
The company writes that the information "may have leaked outside"; it does not say it confirmed that data was taken. This site uses the company's wording. Also, 4.32 million is a count of records, not members, and the notice does not explain how it is counted. In either case it is safest to prepare as if the information has been seen (this site's advice).
What names, addresses, phone numbers and emergency contacts can be used for
The following is what such combinations can generally lead to. The company has not said any of it happened in this incident.
- Name + phone number + email address: targets for convincing calls, emails and texts that claim to be from a travel company, especially ones posing as refunds or changes to a tour payment
- Member ID + name: material for contact posing as member-information or identity checks. A correct member ID does not prove a message is genuine
- Date of birth + address: material for identity-check pretexts or fake notices sent by post
- Emergency contact: material for calling the registered family member, rather than the traveller, with a made-up story that something happened to the traveller
The company says passport and card information are not included. Still, treat any message that asks you for a passport or card number as probably fake.
What operators should review
Because the details of the intrusion have not been published, we list only what follows from what has been disclosed.
- How many member records you keep, and for how long: this involves about 4.32 million records. Decide how long to keep information of members who stopped using the service after registering
- Third parties' information such as emergency contacts: a field that holds someone other than the customer affects those people when it leaks. Keep it only while needed and have a way to review it
- Limiting the harm of a leak: the company says passwords, passport information, card information and account numbers are not included. Keeping sensitive items apart from the reservation system's member data narrows the damage
- Alternative contact while a site is down: while the travel site is stopped, document checks and card payment are unavailable. Check that customers with existing bookings can be told how to reach you by phone
Sources (public records)
The facts here rest on the public information below. We have not guessed at how the intrusion happened or whether data was actually taken.
- Club Tourism Co., Ltd., "Apology and notice regarding personal information leakage due to unauthorized access (First Report)" (October 31, 2026; checked November 1; Japanese) — club-tourism.co.jp
- Club Tourism travel site, system maintenance notice (checked November 1; Japanese) — club-t.com
- KNT-CT Holdings Co., Ltd., IR news 2026 (checked November 1; no disclosure on this incident found; Japanese) — kntcthd.co.jp
Update history
2026-11-01: First version, based on the company's October 31 notice (First Report; checked November 1, no Second Report found). Also checked the travel site's maintenance message and that the holding company's IR news has no disclosure.
Read next
- The same booking-system pattern: Unauthorized access at the reservation system vendor of JAL, ANA and others
- Member-ID data leaked: The H2O ID personal data leak
- Scam messages: What is phishing?
- Protecting your accounts: Choosing multi-factor authentication / Choosing a password manager
- Other 2026 incidents: Data breaches and cyberattacks in 2026 (Japan and worldwide)