Hida Takayama Tourism and Convention Association: attackers planted a program on the Hida Takayama Travel Guide site and took 449 inquiries

1. 2026-10-23

   The contractor that maintains the site noticed suspicious access to the server. Records showed a third party had planted a malicious program on it and downloaded stored inquiries, and outside access was blocked. The same day, Takayama City announced the site was stopped to deal with a critical PHP flaw. [1] [2]

2. 2026-10-25

   The association issued its first report. [1] [3]

449 unique records of people who used the inquiry form between 21 February 2024 and 6 February 2026 or the study visit form between 15 April and 1 July 2026: names (including company and contact names), email addresses, phone numbers, addresses and the inquiry text, with the items varying by person. [1]

The brochure, activity booking and mascot costume forms are not affected. [1]

The association says the attack exploited a flaw in a system on the server, not the widely reported PHP flaw. The site's PHP fix had been applied on 22 October. [1]

Affected people will be contacted by email. The site stays offline until the cause is found, fixes are in place and it is confirmed safe. [1]