2026 Rakuten Travel — unauthorised access to overseas and multilingual booking pages; names, bookings and card last-four data; press counts up to 3.5 million
Data compromised
Names, email addresses, phone numbers, internal IDs and booking details. For some bookings: card last four digits and expiry dates. Hotel staff details on the multilingual site. Press figures: up to about 2.6 million logged-in users on the overseas site and 0.86 million on the multilingual site; up to about 40,000 bookings.
Technical writeup
Rakuten's own notice was not located, so details come from Japanese trade-press reports. Counts vary by outlet. Separate from rakuten-drive2026.
Root cause
Rakuten says an external third party gained unauthorised access to booking web pages on its overseas hotel-booking site (detected September 10, fixed September 16) and its multilingual booking site (detected October 20, fixed October 21). It announced the incident on October 26, 2026.