EXPLORINEER
en

JP — ITmedia

Club Tourism Hit by Unauthorized Access; Up to 4.32 Million Personal Records Possibly Leaked, Website Suspended

Security1 min read

Club Tourism, a Japanese travel company, says hackers may have stolen personal data of about 4.32 million online members. The company has also shut down its website while it investigates.

What happened

On October 31, Club Tourism said someone from outside got into its systems without permission. The company said the personal information of online members may have leaked. The attack was found early on October 30. The company has stopped its website to stop more damage and to look into the problem. It plans to reopen the site once it is sure it is safe.

Key numbers and facts

  • About 4.32 million records may have leaked.
  • Leaked data may include name, nationality, gender, date of birth or age, address, phone number, email address, member ID, and emergency contact.
  • Passwords, passport details, credit card numbers, and bank account numbers are not included, the company says.
  • Customers who never signed up as online members are not affected.
  • The attack was detected at 5:45 a.m. on October 30.

Background

Club Tourism runs an online booking system where customers can sign up as members and book trips. Many Japanese travel companies have faced similar hacks in recent years. Other well-known cases in the article include Rakuten Travel, JAL, ANA, and Muji.

Why it matters

Millions of people may have had their personal details exposed. Hackers can use stolen names, emails, and phone numbers to send scam messages or pretend to be someone else. Customers should be careful with unexpected messages and may want to watch for odd contact about their bookings.

What to watch

  • Whether Club Tourism confirms how many records were really leaked.
  • When the website reopens and whether it is safe.
  • What the investigation finds about how hackers got in.
  • Any new information from investigators and government agencies.

Glossary

Club Tourism
A Japanese travel company that sells tour packages and runs an online booking system.
online booking system
A website or app where people can reserve trips, tickets, or hotels.
emergency contact
A person a customer lists to be reached in case of an emergency.
member ID
A unique number or code that identifies one registered member of a service.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

Securityheise online

Apple Reports Devices Compromised by Spyware

Germany's Federal Office for Information Security (BSI) warned members of the Bundestag and government officials about a possible spyware attack on their phones, according to the ARD Berlin studio. The warning relates to a threat notification Apple sent to iPhone users on October 29, saying it had detected an attack using so-called Mercenary spyware. Digital Minister Karsten Wildberger said the BSI had contacted all affected parties, but did not say which devices were involved.

SecurityThe Verge

Flock keeps ignoring requests to cancel its contracts

As more cities cancel contracts with Flock Safety, some are finding it difficult to end them. Plymouth, Minnesota, got no response from the company after its council voted to terminate, so the police chief had staff disconnect the cameras' power. In Dayton, Minnesota, Flock said removal would take up to 60 days, but it reconnected two cameras without authorization despite a police request not to proceed.

Securityheise online

FBI: North Korea behind multibillion-dollar crypto theft from Binance

According to the FBI, North Korean hackers from the group TraderTraitor carried out the multibillion-dollar attack on the cryptocurrency exchange Binance, which the FBI put at more than $6 billion. The FBI asked companies to block deposits and withdrawals from certain addresses to hinder laundering of the stolen assets. Binance says it has covered 90 percent of the stolen sum and that first withdrawals resumed on Sunday morning.

SecurityZDNet Korea

AI Era Privacy Future: Calls to Unify "Collection and Provision" Under "Processing"

Panelists at the third "Everyone's Debate" forum, held by the Ministry of the Interior and Safety and the Personal Information Protection Commission, argued that Korea's consent-centered privacy system needs legal and safeguard reforms for the AI era. Proposals included merging the separate rules for collection and provision into a single "processing" framework, introducing joint processing, and recognizing "legitimate interest" more broadly while guaranteeing users a clear right to object and request deletion. Participants also noted that differing levels of identifiability and context call for differentiated regulation, and that data learned by AI models may remain even after deletion from databases.