← Club Tourism

2026 Club Tourism — unauthorised access to part of its servers may have exposed about 4.32 million internet-member records; no passwords or card data

2026 4.3M records affected Share on X

Data compromised

Member records from the internet booking system: name (kanji and kana), nationality, gender, date of birth and age, address, phone number, email address, member ID and emergency contact. The company says login passwords, passport information, credit card information and bank account numbers were not included. People who never registered as internet members are not affected, the company says.

Technical writeup

The notice is labelled "first report", so more notices are expected. The company consulted the police and reported to the Personal Information Protection Commission and its supervisory authorities. It plans to contact potentially affected customers in sequence and to continue the investigation with outside investigators, and it plans to restore its website once it is safe. It says no specific secondary harm linked to the incident had been confirmed. A November 1, 2026 notice warns of suspicious emails and text messages impersonating the company. Customer line: 0120-335-255.

Root cause

Unauthorised access from outside, detected at 5:45 a.m. JST on October 30, 2026, on part of the company's servers. The company isolated the affected server, blocked communication from the attack source, and says it has identified the intrusion route and method. It has not described the method publicly. It temporarily suspended its website to limit damage.

References

Breaches you may like