For: anyone who booked or logged in on Rakuten Travel's overseas hotel booking pages, users of Rakuten Travel's foreign-language multilingual booking site, and accommodation staff who use that site's admin screen. This article is based on Rakuten Group, Inc.'s official notice and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 27, 2026Not yet known
- Cause and route of the intrusion
- Period of logins and bookings covered
- Overlap between the 2.6 million and 40,000 records, and number of people
- How and when individual notices are sent
- Whether there is compensation
In its October 26 notice, Rakuten Group says it will contact affected users and bookers individually, in turn, with warnings. It gives no schedule for further updates. We rechecked the notice on October 27 and found no changes.
What users should do today
Work out whether you could be in scope
Incident 1 (up to about 2.6 million records) involves some of Rakuten Travel's overseas hotel booking pages that a Rakuten Group subsidiary manages and operates. The areas the company lists are:
- In scope: some countries and regions in Europe, the US and Canada, and Asia-Oceania
- Excluded: South Korea, Taiwan, Hong Kong, Singapore and Macau
- Partly excluded: parts of Thailand, Vietnam, the Philippines, Indonesia and the US (Hawaii, Guam, Los Angeles and others)
People who logged in on those pages, even without booking, may be in scope. The period covered has not been announced. The notice names only part of the overseas hotel booking pages and the multilingual booking site, and the company says it has not found similar activity on any other site.
Users who logged in to the foreign-language multilingual booking site (incident 2), and accommodation staff who use its admin screen, are also in scope.
Do not use links in messages claiming to be Rakuten Travel
The company says it will contact affected people individually, but the notice does not say how (email or in-app notice). Fake messages tend to appear around the same time as genuine notices.
If an email, text or call says your booking needs confirming, a payment failed or your card details need updating, do not use its links or phone numbers. Check your bookings and notices in the Rakuten Travel app or on an official site you bookmarked yourself.
Correct booking details or card digits are not proof
The affected information includes property names, booking amounts, companions' names, and the card issuer identification number, last four digits, cardholder name and expiry date. A fake message could state all of these correctly.
If you are asked for a full card number, security code, password or one-time passcode, do not give it, however accurate the rest of the message is.
Check your card statement
The company says the affected payment information alone cannot be used for payments (shopping or travel bookings) or cash advances, and it does not ask anyone to reissue their card. Even so, if you paid for an overseas hotel by card, check your statement for charges you do not recognise.
If you entered your card number on a fake site or find an unfamiliar charge, call your card issuer on the number printed on the back of your card.
Stop reusing passwords and turn on two-step verification
The note on the booker item says passwords are not included, and passwords are not listed among the items for logged-in users (up to about 2.6 million records) either. The company has not asked users to change passwords.
Still, a name and email address make it easier to lure people to a fake login page. If you use the same password elsewhere, separate them (choosing a password manager) and turn on two-step verification where available.
Accommodation staff: reach the admin screen from your bookmark
In incident 2, account names and email addresses for up to about 40,000 records of accommodation staff entered in the multilingual booking site's admin screen were affected. If you get an email asking you to log in or confirm your contract, do not use its link; open the admin screen from your usual bookmark. For questions, use the form for accommodation partners shown on the notice page.
1. Email / text / call claiming to be Rakuten Travel or your hotel
Name, property, amount, card last four digits are correct: do not decide here
↓
2. Ignore its links and numbers; open the app or your bookmark yourself
Check the booking, notices and payment status
↓
3a. Request you cannot confirm in the app
Full card number, security code or password: do not give it
3b. The app shows the same notice
Complete it inside the app or official site
What happened (according to Rakuten Group)
The following is based on the notice Rakuten Group, Inc. posted on the Rakuten Travel site on October 26, 2026. The notice covers two separate incidents. Counts are given per incident and per item, so this site has not added them together.
Sep 10, 2026
An anomaly was detected on some of the overseas hotel booking pages managed and operated by the subsidiary Rakuten Travel Xchange (incident 1).Sep 15
Cause of incident 1 identified.Sep 16
System fix for incident 1 completed. A later internal investigation confirmed which information was affected.Oct 20
Possible unauthorized access to the multilingual booking site detected, and the cause identified the same day (incident 2).Oct 21
System fix for incident 2 completed.Oct 26
Notice published on the Rakuten Travel site. The company said it had reported to Japan's Personal Information Protection Commission and relevant overseas authorities.
- Operated by
- Some pages managed and operated by Rakuten Group's subsidiary Rakuten Travel Xchange
- Logged-in customers
- Names, email addresses, phone numbers and internal IDs for up to about 2.6 million records
- Customers who booked
- Names, email addresses, phone numbers, country of residence, internal IDs, booking details (property name, booking amount, etc.) and companions' names and countries of residence for up to about 40,000 records
- Payment information
- Up to about 36,000 of the bookers: card issuer identification number and last four digits, cardholder name, expiry date and card brand
- Not included (per the company)
- Full card numbers and security codes, passwords, passports and other ID documents, and addresses (note on the booker item)
- Operated by
- Rakuten Group
- Logged-in customers
- Email addresses and internal IDs for up to about 860,000 records
- Accommodation staff
- Account names, email addresses and internal IDs entered in the admin screen, for up to about 40,000 records
According to the company, monitoring by its security team found no similar activity on other sites, and no secondary harm or effect on other services attributable to the incident has been confirmed so far. Its listed actions are blocking the access route, fixing the systems, publishing the notice and notifying customers individually, and reporting to the authorities.
What is known and what is not
Status as of October 27, 2026. We will update this table as the company publishes more.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access occurred | Confirmed unauthorized access by an outside third party | Confirmed (company) |
| Names, email addresses, phone numbers (logged-in customers) | Up to about 2.6 million records | Affected (company) |
| Booking details, country of residence, companions' names (bookers) | Up to about 40,000 records | Affected (company) |
| Card issuer ID number, last four digits, cardholder name, expiry date, card brand | Up to about 36,000 records | Affected (company) |
| Full card number and security code | Not included | Not included (company) |
| Passwords, ID documents, addresses | Stated as not included in the note on the booker item; not listed for logged-in customers either | Not included (company) |
| Email addresses (multilingual booking site) | Up to about 860,000 records | Affected (company) |
| Accommodation staff account names and email addresses | Up to about 40,000 records | Affected (company) |
| Number of records actually taken | The notice says the information was "subject to" unauthorized access and does not say whether or how much was taken | Not stated |
| Secondary harm | None confirmed so far | Not confirmed (company) |
| Period of logins and bookings covered | Not stated | Not stated |
| Overlap between 2.6 million and 40,000 records; number of people | Not stated (counts are records) | Not stated |
| Cause and route of intrusion | Cause identified and fixed, but not described | Not stated |
| Compensation | Not stated | Not stated |
Note: the counts are records, not people
Every figure in the notice is "up to about N records" (件). If the same person logged in or booked more than once, the number of people may be lower, and the notice does not say how far the 2.6 million and 40,000 records overlap. The company's wording is that the information was confirmed to be "subject to unauthorized access" (translated); the notice does not say whether data was taken out.
What the combination of affected items could be used for
The following is what this combination of items could generally be used for. The company has not said any of it has happened in this case.
- Name + email + phone number: lets a fake email, text or call claiming to be Rakuten Travel or your hotel address you by name
- Property name, booking amount, companions' names: allows a convincing "about your booking at X hotel" message. Scams posing as booking sites or hotels and asking for payment have been publicly reported in the Booking.com and Temairazu cases
- Card last four digits, expiry date, cardholder name: allows a realistic "payment with your card ending XXXX failed" message used to get the full number or security code
- Accommodation staff account name + email: can be used to lure staff to a fake admin login page
All of these are stopped by not using the message's links and checking in an app or official site you open yourself.
What operators should review
The cause has not been disclosed, so this section covers only what follows from the affected items.
- Display-only card data is still scam material: last four digits, expiry date and cardholder name cannot be used for payment on their own, but they make fake messages convincing. Do not treat them as low risk because they cannot be charged; review how much you keep, for how long, and who can access it.
- People who only logged in can be in scope: here, records of logged-in customers (up to about 2.6 million) far outnumber those of bookers (up to about 40,000). Take stock of which systems hold data on users who never booked, and how much.
Sources (public records)
The facts in this article are based on the public information below. We have not guessed at the cause, period or number of people, which have not been disclosed.
- Rakuten Travel, "Apology and notice regarding some pages of the overseas hotel booking site and the multilingual booking site" (Rakuten Group, Inc., October 26, 2026, Japanese) — travel.rakuten.co.jp
- Travel Voice (October 26, 2026: report on the notice, Japanese) — travelvoice.jp
- Impress Watch (October 26, 2026: report on the notice, Japanese) — watch.impress.co.jp
Update history
2026-10-27: First version, based on Rakuten Group, Inc.'s notice of October 26 (rechecked on October 27, no changes). We will update when the cause, period or compensation is announced.
Read next
- The same scam pattern: The Booking.com booking data breach / TEMAIRAZU unauthorized access
- A travel booking site case: the skyticket (Adventure Inc.) breach
- Another case in the same group: Unauthorized access to Rakuten Drive
- Scam messages: What is phishing?
- Protecting your accounts: Choosing multi-factor authentication / Choosing a password manager
- Other 2026 incidents: List of breaches and cyberattacks (Japan and worldwide)