Japanese tour operator Club Tourism announced on 31 October 2026 that personal data of about 4.32 million members of its online booking system may have been leaked after an intrusion. The company says it detected unauthorized external access to part of its servers at 5:45 on 30 October, and its investigation then found that customer data may have left the network.
What may have leaked: name (kanji and kana), nationality, gender, date of birth and age, address, phone number, email address, member ID and emergency contact. According to the company, login passwords, passport details, credit card data and bank account numbers are not included, and customers who never registered as online members are not affected. 4.32 million is the number of records that may be affected; the company has not said that all of them were taken.
Response: Club Tourism isolated the compromised server, blocked traffic from the attacker, and says it has identified the intrusion route and method and fixed the problems. Its website is suspended while the investigation continues and will return once safety is confirmed. The company has consulted the police and reported to Japan's Personal Information Protection Commission, and will contact affected customers in turn.
Not yet known: how the attacker got in, when the access began, who is behind it, and whether ransomware was involved. The company says no secondary harm has been confirmed so far. NHK, Yomiuri and ITmedia, among others, have reported the incident.
