OpenDoor: Travelko website breach exposes 381,926 email addresses

A Travelko website breach exposed 381,926 email addresses, some with prefectures or postcodes. This is separate from the earlier mail-provider attack.

Disclosed

2026-11-09

Organizations involved

Leaked or at risk

381.9K

381,926

Downtime

Unknown

Separate attacks with overlapping recipients

On 6 November, OpenDoor confirmed unauthorized access to its travel-comparison website and exposure of newsletter recipients. Of 381,926 email records, 152,655 include a registered prefecture and 616 a postcode. It reports no exposure of names, detailed addresses, phones, gender, birth dates, passwords or cards. [1]

The notice explicitly distinguishes this incident from the mail-contractor attack disclosed on 4 November. Most addresses overlap, so their counts are not added together. The entry route was blocked and safety measures completed. Newsletters remain stopped; other services are available. Police and relevant authorities, including the PPC, were contacted. [1]