Club Tourism: intrusion into a server under construction put 3,349 overseas tour records with passport numbers and 5,078 photo contest entries at risk

1. 2024-10-30

   In the evening, the company it had commissioned to build systems reported that part of a server under construction had been accessed without authorization. It isolated the server. [1]

2. 2024-11-01

   It announced the case after consulting the police and reporting to the Personal Information Protection Commission and other bodies. [1] [2]

3. 2024-11-22

   It newly confirmed that photo contest entrant data was also on the breached server. [1]

4. 2024-12-06

   It published the investigation results. There was no clear trace of data being sent out and none of damage spreading to other servers. It gave the contractor's lack of security measures as the cause. [1]

The data at risk is 3,349 flight booking log entries from overseas tour applications in March to August 2020 and October 2023 (romanized names, gender, birth date, passport number and expiry, flight reservation number; some lack birth date and passport data) and 5,078 photo contest entries (name, pen name, prefecture). No address, phone number, email address or payment data is included. [1]