travel
7 articles with this tag
Club Tourism Unauthorized Access and Possible Personal Data Leak (About 4.32 Million Records): What Members With Names, Addresses, Phone Numbers and Emergency Contacts Should Do
Club Tourism Co., Ltd. (Japan) announced on October 31, 2026 that it detected unauthorized access from outside at 5:45 on October 30 and that information of internet members registered in its internet reservation system may have been leaked outside (First Report). The items are name (kanji and kana), nationality, sex, date of birth and age, address, phone number, email address, member ID and emergency contact. The count is about 4.32 million records. Login passwords, passport information, credit card information and bank account numbers are not included, it says. Information of people who have never registered as internet members is not affected, and no specific secondary damage attributed to this incident has been confirmed. The company says it isolated the server, identified and fixed the intrusion route, has stopped its website to prevent further damage and investigate, consulted the police, and reported to the Personal Information Protection Commission and its supervising authority. This site's conclusion: if someone claiming to be the company calls, emails or texts you, do not use the links or numbers in the message; check on the official site, at a branch, or through the contact in the notice.
Rakuten Travel Unauthorized Access (Up to About 2.6 Million Records): Names, Contact Details and Partial Card Data from Overseas Hotel Bookings, and What Users Should Do
On October 26, 2026, Rakuten Group, Inc. announced that it had confirmed unauthorized access by an outside third party to some pages of Rakuten Travel's overseas hotel booking site, managed and operated by its subsidiary Rakuten Travel Xchange, and to the multilingual booking site that Rakuten Group operates. On the overseas hotel booking pages (incident 1), an anomaly was detected on September 10 and the system fix was completed on September 16. The information that was subject to the unauthorized access covers names, email addresses, phone numbers and internal ID numbers for up to about 2.6 million records of logged-in customers, and, for up to about 40,000 records of customers who booked, names, contact details, country of residence, booking details and companions' names; payment information (card issuer identification number and last four digits, cardholder name, expiry date and card brand) for up to about 36,000 of those. Full card numbers, security codes, passwords, ID documents and addresses are not included (per the note on the booker item). On the multilingual booking site (incident 2), detected on October 20 and fixed on October 21, email addresses and internal IDs for up to about 860,000 records of logged-in customers, and account names and email addresses for up to about 40,000 records of accommodation staff entered in the admin screen, were affected. The cause, the period covered and any compensation have not been announced. This site's conclusion: a message asking you to re-enter your card number or pay is not genuine just because it gets your booking or your card's last four digits right. Do not use links in emails or texts; check your booking in the Rakuten Travel app or a bookmarked official site.
skyticket (Adventure Inc.) Data Breach (About 14.64 Million Records): Passwords, Refund Bank Details and Some Users' Card Data Exposed — What Users Should Do Today
On October 9, 2026, Adventure Inc. announced three separate incidents of unauthorized access, each by a different route, affecting its travel comparison and booking site skyticket. In the first, an administrative function was misused and used as a starting point to reach other servers and data stored in the cloud; about 14.64 million records leaked, including names (also as written in passports), dates of birth, email addresses, phone numbers, addresses and the remitter name used for bank transfers, and about 4.13 million of them included hashed member passwords. In the second, a vulnerability in a business management system was exploited, and 17,780 records (including duplicates, with more still being counted) containing refund bank account details leaked or may have leaked. In the third, a bus booking completion page could be displayed without logging in, and about 12,000 bookings were or may have been viewed. The company first said card numbers were not among the leaked data, but corrected this in a second notice on October 16: the card number, cardholder name and expiry date (for some, the number only; no security codes) of up to 6,140 people who registered or used a credit card to pay the "skyticket Premium" membership fee between February 2017 and June 2018 leaked in the first incident, along with member IDs, names and passwords for a welfare benefits service offered as a Premium perk. Passport images were not exposed, and as of the October 9 notice the only confirmed secondary harm was one unauthorized login to a member account (the second notice does not say whether the leaked card data has been misused). This site's take: members should change their password from the official site or app today, change it anywhere it was reused, check card statements from October onward if they registered or used a card for the Premium fee in that period, ignore messages about refunds, compensation or booking changes, and never give anyone a bank PIN or one-time code.
TEMAIRAZU Unauthorized Access (2026): Guest and Hotel Guidance
On September 28, 2026, Temairazu, Inc. announced unauthorized access to its TEMAIRAZU Series, a system hotels and ryokan use to manage bookings from many sources in one place. From late at night on September 21, guests of properties using the system began receiving suspicious messages via messaging apps such as WhatsApp, by email and by SMS. The messages appeared to know booking details and, under pretexts such as advance check-in or keeping a reservation valid, pushed recipients to external websites to enter card details or pay. In its second report of October 7 (English version October 8), the company listed the information that may have been viewed or obtained by a third party: guest names, telephone numbers, email addresses, accommodation property names, check-in dates, check-out dates and accommodation charges. It does not retain credit card information or login credentials for booking sites. In a timely disclosure to investors on October 9, it put the number of people whose booking information is involved at up to about 4.45 million and said it had commissioned an external security firm to investigate. According to notices from hotels using the system, the cause was a security problem in part of an installed product the company provided in the past, fixed on September 26. This site's take: people who booked through travel sites may be affected too. If a message claiming to be your hotel asks you to re-enter card details or pay, refuse even if the details are correct, and check through the booking site's official app or the phone number on the hotel's official website.
Booking.com Reservation Data Breach: How to Spot Scam Messages Posing as Your Hotel
In April 2026 Booking.com notified guests that unauthorized third parties may have been able to access certain booking information, updated the PINs of the affected reservations, and said it had contained the issue. According to the notice and the company's spokesperson as reported, the information included booking details, names, email addresses, phone numbers and messages shared with properties; financial information was not accessed. The number affected and the cause were not disclosed. This site's take: a correct hotel name, date and price no longer prove anything. The test is whether a request matches the payment policy in the booking you open yourself in the official app. Refuse any request to re-enter card details, pay through a link, or make a transfer not in the policy.
Manchester Airports Group (MAG) Data Breach (2026): What to Check
In a statement dated August 27, 2026, Manchester Airports Group (MAG) said it was subject to a cyber security incident by an unauthorised third party in August 2026, and that customer data relating to car park, lounge and Fast Track bookings and in-airport Wi-Fi sign-ups at Manchester, London Stansted and East Midlands airports was obtained. The data includes email addresses, phone numbers, vehicle registrations and postcodes. MAG says neither it nor the system accessed holds customers' bank or payment details. MAG says that for people notified that they were affected, their data was made publicly available. According to press reports, a MAG spokesperson put the number affected at roughly 8.7 million. Operational airport systems were not involved. Contact details combined with a vehicle registration or postcode can make a fraudulent message seem more convincing. Whatever a 'refund', 'booking problem' or 'parking fine' message says, don't follow its link; open the airport's official Manage Booking page yourself. MAG says changes and cancellations there are free.
Trenitalia Data Breach: Protecting Yourself from Fake Delay-Refund Scams
Italian rail operator Trenitalia sent customers a notice under Article 34 of the GDPR saying a cybersecurity incident caused by unidentified external parties led to unauthorised access to some personal data linked to travel tickets (titoli di viaggio). Follow-up notices for jointly controlled tickets describe it as the same event Trenitalia communicated on June 26, 2026. The data may include name, date and place of birth, email and phone number, itinerary details such as route, date, time and ticket number, loyalty card code, employer, and identity document details; the notice for UnicoCampania regional tickets also lists the Italian tax code (codice fiscale) and gender. Trenitalia says account login data, passwords and payment information were not involved. It notified the Italian data protection authority (Garante) and CSIRT Italia and filed a criminal complaint with the Rome prosecutor. This site's take: what leaked is an itinerary — when, where and on which train — and that is exactly what makes a fake 'your train was delayed, claim your refund' message convincing. Real delay compensation is either requested by you through Trenitalia's own channels or, for regional digital tickets, paid automatically to the card you bought with. No genuine refund asks you to type your card number into a link from a text message.