October 31, 2026: Club Tourism, a Japanese travel company, said unauthorised access from outside may have exposed member records from its internet booking system. The company puts the figure at about 4.32 million records, and says passwords, passport details, card numbers and bank account numbers were not included. The catalog entry records the company's statements.
What happened
Club Tourism says it detected the access at 5:45 a.m. Japan time on October 30, 2026. The notice says the attack reached part of the company's servers. The company isolated the affected server, blocked communication from the attack source, and says it has identified the intrusion route and method. It has not described that method publicly. It has temporarily suspended its website to limit damage, and it plans to restore it once it is safe. The company consulted the police and reported the incident to Japan's Personal Information Protection Commission and its supervisory authorities.
What data may have been viewed
- Name, in kanji and kana.
- Nationality, gender, date of birth and age.
- Address, phone number and email address.
- Member ID and emergency contact.
The records come from people registered as internet members. The company says people who never registered as internet members are not affected.
What the company says was not included
- Login passwords.
- Passport information.
- Credit card information.
- Bank account numbers.
Verified and unverified
- Confirmed by the company: unauthorised access detected on October 30; the data categories above; the figure of about 4.32 million records; the exclusions above; the police and regulator reports; and the website suspension.
- Unverified or unknown: who carried out the attack; how the intruder got in beyond the company's general description; and whether any data has been misused. The company says it has not confirmed any specific secondary harm linked to the incident. The notice is labelled "first report", so more details are expected. We did not find a later notice when we checked.
What to do
- If you are a Club Tourism member, log in and check your account details. The company says passwords were not included, but change the password if you reuse it on other sites.
- Expect phishing. The company has warned that suspicious emails and text messages are impersonating it. Do not click links in unexpected messages.
- Do not enter card or bank details on any page reached from an email or text. The company says it will never ask for card numbers, bank details, PINs, passwords or My Number by phone, email, SMS or mail.
- To ask questions, call the company's dedicated line, 0120-335-255. It is open on weekdays from 9:30 to 17:00, and during November also on weekends and holidays.
- Be wary of unexpected tour, booking or account messages. Names, dates of birth and contact details are the data at risk.
Sources and sourcing note
- Club Tourism, "Notice regarding personal information leak due to unauthorized access (first report)," October 31, 2026 (Japanese)
- Club Tourism, notice warning of suspicious emails and SMS impersonating the company, November 1, 2026 (Japanese)
Sourcing note: this account comes from the company's own notice, read in Japanese, and it is labelled a first report. Later notices may change the figures. Our searches did not turn up independent news coverage at the time of writing.