For: customers registered with the Skyliner Ticketless Service. This article is an explanation based on Keisei Electric Railway's official notice; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
customers registered with the Skyliner Ticketless Service.
- Confirmed so farSee the table ↓
- Occurrence
- System affected
- Cause
Listed as possibly affected
- Count
- User ID
- Password
2 more
- Name in kana
- Phone number, email address
- Not yet confirmed
- Cause (how the access happened)
- When it was detected and how long the access lasted
- Confirmed items and final count
3 more
- When individual notices will be sent
- When the seat reservation system will resume
- Whether the data has been misused
- What to do nowSee the steps ↓
- Do not respond to contact in Keisei's name
- Change the password on services where you reused it
- Check whether you reused it
3 more
- Check whether you are affected through individual contact and the official contact point
- If you plan to travel to the airport, decide how you will buy your ticket
- If you entered details or sent money, get help right away
- Where to verify (source)All sources ↓
- Keisei Electric Railway, "[Apology] Unauthorized access to the Skyliner seat reservation system" (November 13, 2026, in Japanese)
- Last checked
- As of November 15, 2026
Follow-up plans and what we checked
In its notice of November 13, 2026, the company says it will contact affected customers individually at their registered email address at a later date. When we checked the notices on the company's official site on November 15, 2026, we found no follow-up after the November 13 notice.
What users should do today
Do not respond to contact in Keisei's name
The information that may have been obtained includes name (in kana), phone number and email address. The notice does not include a warning about suspicious contact, but someone who has these details can more easily make a genuine-looking message that pretends to confirm a booking or apologize (this site's view).
For any email, text or call such as "please confirm your reservation" or "we will refund you or add points as an apology", do not open the link, do not call back the number, and open Keisei's official site yourself to check. The company says it will contact affected customers at their registered email address. If you cannot tell whether a message is genuine, ask through the contact point listed in the official notice. For how to spot fakes, see What is phishing?.
Change the password on services where you reused it
The company says the passwords are encrypted, so a third party cannot recover them. The notice does not ask users to change passwords. However, the user ID may have been obtained together with it. If you use the same combination of user ID and password on other services, it is safer to change it there first as a precaution (this site's view).
Use a different password for each service and turn on two-step verification for important accounts. See How to choose a password manager and How to choose multi-factor authentication. While the seat reservation system stays suspended, you may not be able to log in to change your password for the company's own service. Follow the company's guidance once service resumes.
Check whether you reused it
To see whether your email address appears in past leaks, see How to check whether your password has leaked. Also look for login alerts or actions you do not recognize on your other services.
Check whether you are affected through individual contact and the official contact point
The company says it will contact affected customers individually at their registered email address at a later date. Before opening a link in an email you receive, check that the content matches the notice on the official site.
The contact point in the notice is the customer inquiry line (phone 090-3248-4609, Japan). It says the line is open on weekdays 9:30 to 17:00, until 21:00 on Friday, November 13, and 10:00 to 15:00 on Saturday, November 14 and Sunday, November 15. Use the contact point on the official notice, not a number written in an email or text message.
If you plan to travel to the airport, decide how you will buy your ticket
The company says it has suspended the whole Skyliner seat reservation system to strengthen security. It asks users to wait until service resumes and gives no date. Skyliner tickets are still on sale at station counters and ticket machines.
If your departure is soon, plan to buy at the station and leave extra time. Also beware of fake notices or sites that pretend to be the reservation system, and check the latest status on Keisei's official site.
If you entered details or sent money, get help right away
If you entered card or personal details on a page linked from a suspicious message, or sent money, contact your card company or bank immediately. In Japan you can also call the police consultation line (#9110) or the consumer hotline (188). For suspicious activity on an account, see How to check for unauthorized access.
What happened (from Keisei's notice)
On November 13, 2026, Keisei Electric Railway published "[Apology] Unauthorized access to the Skyliner seat reservation system" on its official site (in Japanese). Everything below is the company's own statement.
Nov 11 (Wed), late at night
A third party gained unauthorized access to the Skyliner seat reservation system.Nov 13
Notice published. The company says it will contact affected customers individually at their registered email address at a later date.As of the notice
To strengthen security, the whole seat reservation system is suspended. Skyliner tickets are still on sale at station counters and ticket machines.
- Occurrence
- Late at night on Wednesday, November 11, 2026 (unauthorized access by a third party to the Skyliner seat reservation system)
- Count
- Up to about 3.37 million (Skyliner Ticketless Service customer information may have been obtained)
- Information that may have been obtained
- User ID, password, name in kana, phone number, email address. The passwords are encrypted, so a third party cannot recover them
- Response
- Affected customers will be contacted individually at their registered email address at a later date. The whole seat reservation system is suspended. Skyliner tickets are still on sale at station counters and ticket machines
- Contact
- Customer inquiry line, phone 090-3248-4609 (weekdays 9:30 to 17:00; until 21:00 on Fri Nov 13; 10:00 to 15:00 on Sat Nov 14 and Sun Nov 15)
What is known and what is not
Summarized from the company's notice (November 13) as of November 15, 2026. We will rewrite the status column when more is published.
| Item | What the notice says | Status |
|---|---|---|
| Occurrence | Unauthorized access by a third party late at night on Wed, Nov 11, 2026 | Confirmed (company) |
| System affected | Skyliner seat reservation system | Confirmed (company) |
| Count | Up to about 3.37 million records | Possible (company; upper figure) |
| User ID | Among the information that may have been obtained | Possible (company) |
| Password | May be included. Encrypted, so a third party cannot recover it | Possible (company; says not recoverable) |
| Name in kana | Among the information that may have been obtained | Possible (company) |
| Phone number, email address | Among the information that may have been obtained | Possible (company) |
| Name in kanji, address, date of birth | Not listed as items | Not stated |
| Credit card information, booking or ride history | Not listed as items | Not stated |
| Cause | Unauthorized access by a third party | Confirmed (company) |
| Route and method of access | Not stated | Not stated |
| Time of detection, duration of access | Not stated (only "late at night" for the occurrence) | Not stated |
| Misuse | No confirmed misuse found in the notice | Not stated |
| Individual notices | Affected customers will be contacted at their registered email address at a later date | Planned (company) |
| Use of the seat reservation system | The whole system is suspended. No resumption date given | Suspended (company) |
| Sales at station counters and ticket machines | Skyliner tickets are still on sale | Continuing (company) |
| Reports to authorities | Not stated in the notice | Not stated |
What names, phone numbers and email addresses can be used for
The table below shows what can generally happen with these combinations of items. It does not mean this happened in this incident.
| Item that may have been obtained | What can generally happen | What users should do |
|---|---|---|
| Name + email address | Emails that pretend to confirm or change a booking, or to refund as an apology | Do not open links; open the official site yourself |
| Name + phone number | Texts or calls that pretend to check a reservation or payment | Do not call back; contact the official contact point yourself |
| User ID + password (encrypted) | The company says they cannot be recovered. If reused, they can generally be used in login attempts on other services | Change reused passwords on other services and turn on two-step verification |
What can happen with the information that may have been obtained
- Genuine-looking emails, texts and calls in the name of Keisei or a Skyliner booking
- Attempts to get card numbers and other details under the name of an apology or refund
- Login attempts on other services where the same combination is reused
Not listed as items in the notice
- Credit card information (not listed as an item)
- Name in kanji, address and date of birth (not listed as items)
- Passwords in a recovered form (the company says they cannot be recovered)
What operators should review: how a reservation system holds member data
The cause has not been disclosed, so this section only says what follows from the facts that were.
- Storing passwords in encrypted form is a given, not the whole answer: the company says the passwords are encrypted and cannot be recovered. Storing passwords in a form that cannot be reversed limits the damage when data leaks (for how, see Password hashing). But user IDs, names, phone numbers and email addresses are still material for genuine-looking contact. Holding only the items you need, and narrowing what can list or retrieve member data, matters just as much.
- Decide how to suspend, and keep another way to buy: the company has suspended the whole system to strengthen security while keeping sales open at station counters and ticket machines. When you stop online booking, keeping a route through which users can still buy limits both the spread of damage and user confusion.
Sources (public record)
The facts in this article are based on the official notice below. We do not speculate about details of the cause that were not disclosed.
- Keisei Electric Railway, "[Apology] Unauthorized access to the Skyliner seat reservation system" (November 13, 2026, in Japanese) — keisei.co.jp (PDF)
- Keisei Electric Railway official site (notices) — keisei.co.jp
Update history
2026-11-15: First version. Based on Keisei's notice of November 13. We checked the notices on the company's official site the same day and found no follow-up.
Read next
- A similar reservation-service incident: Unauthorized access to JAL and ANA reservation data
- How to spot fake contact: What is phishing? / Smartphone security basics
- Protect your passwords: How to choose a password manager / How to check whether your password has leaked
- Other incidents in 2026: Data breaches and cyberattacks (Japan and overseas)