Navac: RESERVE GATE alpha breach affects up to about 350,000 booking-member records
A booking-system flaw exposed up to about 350,000 member records, including contact and stay details. Suspicious messages to guests have been reported.
Disclosed
2026-11-04
Organizations involved
2
Leaked or at risk
350K
350,000
Downtime
Unknown
What happened
Unauthorized access exploited a booking-system flaw on 2 November. Up to about 350,000 member records contain names, addresses, phones, emails, hotel names and check-in dates. Navac has not confirmed exposure of card data or passwords. [1]
Response and precautions
Member pages of RG alpha and other booking systems cannot proceed after login. Osaka Corona Hotel also disclosed likely exposure of direct-booking members and observed messages using actual stay details while impersonating police investigations or identity checks. It advises against opening their links/attachments or supplying identity or payment information. [1] [2]
Timeline
- Started 2026-11-02
- Disclosed 2026-11-04
- 2 days
Attack or cause
- Method
- [Web app exploit]
- Impact
- [Data leak][Service outage]
- Entry point
- Web app
Data exposed or at risk
Supply chain
Services hit
Organizations involved
[Breached][Critical]Tokyo, MinatoInformation and communications350,000 leaked
Navac Inc.[Through a supplier][Major]Osaka, Osaka, HigashiyodogawaAccommodation, food and drink
Osaka Corona Hotel Inc.Members who booked directly on its site are likely affected; names, contacts and stays are at risk, with no count given. Card details were not stored.
Sources
- [1][Official]不正アクセスによる個人情報漏えいに関するお知らせとお詫びNavac Inc. · 2026-11-04
- [2][Official]【重要なお知らせ】委託先システムへの不正アクセスによる個人情報流出の可能性とお詫び・ご注意のお願いOsaka Corona Hotel · 2026-11-04