Rakuten Group: unauthorized access to Rakuten Travel's overseas hotel pages and multilingual booking site

On 26 October Rakuten Group said a third party had accessed two sites of its Rakuten Travel booking service. The first was part of the overseas hotel booking pages run by its subsidiary Rakuten Travel Xchange, where an anomaly was detected on 10 September and fixed on the 16th. Names, email addresses, phone numbers, country of residence, booking details and companions' names of up to about 40,000 bookings were affected, about 36,000 of them with the card's issuer number and last four digits, holder name, expiry and brand, but no full card numbers, security codes, passwords or addresses. Names, email addresses and phone numbers of up to about 2.6 million users who logged in on those pages were also affected. The second was the multilingual booking site, where access was detected on 20 October and fixed the next day: email addresses of up to about 860,000 users who logged in, and account names and email addresses of up to about 40,000 accommodation staff who used its admin screen. The Asahi Shimbun puts the total at up to about 3.54 million. No misuse has been found, and the company reported the case to the Personal Information Protection Commission and overseas authorities.