Okinawa Tourist Service: personal data of up to 730,000 people leaked from its booking services

On October 21, Okinawa Tourist said an initial investigation following an outside inquiry found possible personal data exposure. It blocked external access to the affected site from October 18 and has suspended new bookings for OTS Rent-a-car, OTS HOTEL, OTS ACTIVITIES, its digital DMO platform and OTS Club since 16:30 on October 20. Its second report on October 23 said the leak was confirmed because data circulating outside matched its own records, and up to about 730,000 people are affected. The system held names, birth dates, gender, addresses, phone numbers, email addresses, Facebook IDs, and Japanese driver's licence numbers with issue and expiry dates. Whether licence images (up to 6,000) in a separate database leaked is still under investigation; no card data was stored. It has reported the case to the police and the Personal Information Protection Commission. On 23 October the Ryukyu Shimpo reported that Singapore-based threat intelligence firm Cyfirma had, in a May report, found a dark web post claiming to hold and sell the company's customer data; the report did not verify the data. On 27 October NHK also reported that the leaked data may have been sold on a dark web site, which the company is looking into. Both claims are unverified.