[Investigating][Severity: Critical][Intrusion]

Club Tourism: online booking system intrusion

A break-in at Club Tourism's servers may have leaked about 4.32 million online member records with names, addresses, dates of birth, nationality and emergency contacts.

Disclosed

2026-10-31 22:25

Organizations involved

Leaked or at risk

4.3M

4,320,000

Downtime

Unknown

What happened

2026-10-30
At 05:45 Club Tourism detected unauthorized access from outside and cut off traffic to the affected part. Its investigation then found that some member data may have leaked. [1] [4]
2026-10-31
It disclosed the incident in its first report. Its website is down for the investigation and to prevent further damage; bookings are taken by phone meanwhile. [1] [2] [3]
2026-11-01
Parent KNT-CT Holdings also apologized and said it would tighten oversight of group companies. [5]

Impact

About 4,320,000 records of people registered as online members of its online booking system may have leaked: names in kanji and kana, nationality, gender, dates of birth and ages, addresses, phone numbers, email addresses, member IDs and emergency contacts. Login passwords, passport details, credit card details and bank account numbers were not included. People who never registered as online members are not affected. [1] [4]

Response

It isolated the affected server, blocked traffic from the attacker and says it identified the route and method of intrusion and fixed the problems, without saying what the route was. It consulted the police and reported to the Personal Information Protection Commission and its supervising authority. It is contacting affected people in turn and set up a dedicated helpline. It advises changing passwords reused on other services and warns about calls, emails and text messages posing as the company. No secondary damage has been confirmed. [1]