EPARK Relax & Esthe: unauthorized access to the PeakManager booking system

EPARK Relax & Esthe detected unauthorized access and deletion in its PeakManager booking/customer database on July 27 and disclosed possible exposure of about 33 million records on July 31. Its September 24 follow-up confirmed external transfer and deletion. Deduplication using phone/email details reduced the scope to about 22.18 million records, which cannot be converted reliably into unique people. Exposed fields included names, contacts, birth dates, gender and treatment notes, some containing health information. It corrected the initial exclusion of card data: five notes potentially contained expired card details, whose authenticity and accuracy were unverified. Encrypted passwords had also been included in the initial risk scope. Deleted data was restored; no impact on other systems or secondary misuse was confirmed.