Adventure: unauthorized access to skyticket servers
On skyticket, the booking comparison site run by Adventure, an admin function was misused from 2 to 4 October to reach other servers and cloud data. About 14.64 million records leaked with names, birth dates, email addresses, phone numbers and addresses; about 4.13 million included hashed login passwords. A second report on 16 October corrected the first: card numbers and other card data of up to 6,140 skyticket Premium users also leaked from fee payment logs kept since before July 2018.
Disclosed
2026-10-09
Organizations involved
1
Leaked or at risk
14.6M
14,640,000
Downtime
Unknown
Timeline
- Started 2026-10-02
- Detected 2026-10-05
- Disclosed 2026-10-09
- 7 days
Attack or cause
- Method
- [Intrusion]
- Impact
- [Data leak]
- Entry point
- Unknown
Data exposed or at risk
Services hit
Organizations involved
[Breached][Critical]Tokyo, ShibuyaPersonal services and entertainment
Adventure, Inc.
Sources
- [1][Official]不正アクセスによるお客様情報の流出に関するお詫びとお知らせAdventure · 2026-10-09
- [2][Official]不正アクセスによるお客様情報の流出に関するお詫びとお知らせ(第2報)Adventure · 2026-10-16