KidZania: unauthorized access to the website leaked personal data of 24,644 KidZania Tokyo bookers

KCJ GROUP, which runs KidZania, announced on 22 October 2024 that the KidZania website had been accessed without authorization by an outside third party and that personal data may have leaked. It detected the access on 16 October and took defensive measures; on the 17th it found that data may have leaked and blocked it that day. In its investigation report on 6 December it said a vulnerability in part of the website's program was the cause, and that names, email addresses, phone numbers and addresses of 24,644 people who registered when booking KidZania Tokyo before 17 October had leaked. Card data, data of children and anyone other than the person booking, and bookings for KidZania Koshien and KidZania Fukuoka are not affected. It reported to the Personal Information Protection Commission and the police.