skyticket (Adventure Inc.) Data Breach (About 14.64 Million Records): Hashed Passwords and Refund Bank Details Exposed — What Users Should Do Today

In the first incident, about 4.13 million member login passwords leaked in hashed form. Hashing converts a password into a form that is hard to turn back, but the company itself warns that passwords may be worked out through analysis and used for unauthorized logins (how hashing works: What is password hashing?).

The company asks members to change their password. Do it by logging in to the official skyticket site or app, not through a link in an email. The company says its emails do not contain any link asking you to enter a password.

The company asks people who use the same password elsewhere to change it there too. A recovered password can be tried together with your email address on other sites.

Start with the accounts that would hurt most if taken over: email, online banking and shopping sites. If you are not sure where you reused it, see how to check whether your password leaked and how to choose a password manager.

As of October 10, skyticket's notices say nothing about two-step verification. On the other services you change, turn it on if it is offered (see choosing multi-factor authentication).

The company asks users to check the booking history in their account and their credit card statements. Card numbers did not leak, but if someone logs in to your account, a saved card could be used to book. To prevent this, the company suspended payment with saved cards and card saving at around 6 p.m. on October 7.

Report unknown bookings to the company's contact and unknown charges to your card issuer. The company says it confirmed one unauthorized login to a member account on September 9.

The company warns that emails, text messages, calls and letters pretending to be the company, banks, airlines or bus operators may arrive. With names, dates of birth, phone numbers and addresses exposed, such messages can look convincing.

The company says it will never ask for payment in connection with this incident. Treat any message asking you to transfer money, pay a fee or install an app in the name of a refund or compensation as fake. Do not use the links or phone numbers in it; check through the official site you open yourself (see What is phishing?).

The emails the company has been sending since October 8 come from info@skyticket.com, in four subject variants beginning "【重要】不正アクセスによるお客様情報" with an English line such as "[Important] Apology for Information Leak Due to Unauthorized Access". The company says mail from any other address, or mail asking you to enter a password, may be a fake.

In the second incident, refund bank details (bank name, branch, account type, account number and account holder name) leaked or may have leaked. The company says this information alone does not let anyone withdraw money immediately.

The danger is a contact posing as a refund process to obtain your PIN or online banking ID and password. The Japanese Bankers Association says it never asks customers for PINs or passwords, and Japan's National Police Agency says police officers never ask for PINs by phone. The same goes for one-time passwords: do not give them out by phone or text message.

Check your passbook or banking app for transactions you do not recognize, and contact your bank if you find any. We found no official guidance saying the account must be replaced only because the number leaked. If you are worried, call your bank using the number on your card or its official site.

In the third incident, the bus booking completion page could be displayed without logging in between August 3 and October 1, 2026. Trip date and time, boarding and drop-off points, operator, service name and the operator's booking number were among the items viewed.

The company warns that someone with this information may pose as the company or the bus operator and ask you to change or cancel the booking or pay an extra fee. You can check or cancel bookings 24 hours a day under "予約確認" (booking confirmation) in your account. If a booking was changed or cancelled without your knowledge, contact the company.

The contact in the company's notice is the "skyticket inquiry desk for the personal data leak" (email: info@skyticket.com). The company's October 8 notice on its corporate site gives hours of 10 a.m. to 6 p.m. daily. As of October 10, the company says inquiries are very high, phones are hard to reach and email replies are delayed. Do what you can yourself, such as changing your password, while you wait.

The company says the third incident's completion page could be shown without logging in and was viewed by a third party in an automated way during that period (August 3 to October 1). Completion pages and the pages linked from confirmation emails gather names, contact details and booking numbers in one place.

Check whether the page verifies who is looking. Require a login, or, if it must work without one, put a long unguessable string in the URL and give it an expiry. In general, if changing a number in the URL shows someone else's booking, that is a classic flaw called IDOR (background: authentication vs authorization).

"Viewed in an automated way" means far more requests than a person would make. For a page like a booking completion page, which one person rarely needs to open repeatedly, cap the number of views per source and alert someone when the cap is hit.

You can measure in the application or in front of it, at the web server or CDN (content delivery network). How to start is covered in rate limiting and abuse control.

After password hashes leaked, the company suspended payment with saved cards. If a hijacked account can pay with a saved card, fraudulent purchases happen even when no card number has leaked.

Check in advance whether your site can switch off saved-card payment on its own, or require the card issuer's authentication (3-D Secure) on each payment. If there is no switch, you will be building one on the day of the incident.

The second incident involved refund bank details held in a business management system. A refund is often a one-off process, so decide how long to keep bank details once the refund is complete, and delete them automatically when that time is up. Data you no longer hold cannot leak.