Club Tourism Hit by Breach: 4.32 Million Records at Risk

Japanese travel agency Club Tourism said on October 31 that an unauthorized intrusion may have leaked personal data on about 4.32 million records belonging to its online members. The company has taken its website offline while it investigates.

What data is affected

The exposed information covers customers registered as members of the company's online booking system. It includes names, nationality, gender, date of birth or age, address, phone number, email address, member ID and emergency contacts.

According to the company, customers who never registered as online members are not affected. Passwords, passport information, credit card data and bank account numbers were not part of the exposed data.

Response and timeline

Club Tourism detected the unauthorized access at 5:45 a.m. on October 30. An internal investigation then found that information may have been leaked externally.

The company isolated the compromised server and blocked traffic from the source of the attack. It says it has identified the intrusion route and method and fixed the weaknesses involved. It will keep investigating with the help of external investigators and the relevant authorities.

To prevent further damage and to support the inquiry, the website remains suspended. Club Tourism plans to restore it once it has confirmed its safety again.

Why it matters

Although no passwords or payment details were involved, the combination of names, addresses, phone numbers, email addresses and emergency contacts is enough to fuel targeted phishing and impersonation attempts. Affected members should be wary of unsolicited messages that reference their travel bookings or membership.

The incident adds to a run of breaches at Japanese travel and consumer services firms in recent months, which has put booking platforms and their security practices under closer scrutiny. Club Tourism has not yet said when the site will return.