Club Tourism Says Hack May Have Exposed 4.32m Member Records

Japanese tour operator Club Tourism says a Club Tourism data breach may have exposed about 4.32 million records of its online members, after attackers reached part of its servers. The company says it cut off the affected systems on the day it detected the intrusion and that login passwords, passport details, credit card data and bank account numbers were not part of the data at risk.

In a notice published on 31 October, Club Tourism says it detected unauthorised access from outside at 5:45 on 30 October, Japan time, began an investigation at once and blocked communications to the affected part of its network. Its parent company, KNT-CT Holdings, apologised on 1 November and said it would tighten its oversight of group companies.

What the Club Tourism data breach covers

The data at risk belongs to customers registered as internet members of the company’s online booking system. According to the notice, it covers names in kanji and katakana, nationality, gender, date of birth and age, home address, phone number, email address, member ID and an emergency contact.

The company puts the scope at about 4.32 million records. Customers who never signed up as internet members are not affected, it says.

Club Tourism stresses what the attackers did not reach. Login passwords, passport information, credit card information and bank account numbers were not included. The company says it has not confirmed any concrete secondary harm linked to the incident so far.

How the company says it contained the attack

The notice sets out the steps already taken. The server that was accessed has been isolated and traffic from the attackers blocked. The company says it has identified the route and method of the intrusion, fixed the problems it found and checked the extent of the damage and whether similar events had occurred.

The Club Tourism website has been taken offline to stop further damage and allow the investigation, and will return once its safety has been reconfirmed. The company says it has consulted the police and reported the incident to Japan’s Personal Information Protection Commission and to its supervising ministry. It will contact affected customers in turn and is working with investigators and other outside bodies.

The notice is labelled as a first notice, so further updates are expected.

Fake calls and emails are the main risk

For members, the immediate danger is less the leak itself than what criminals can do with a clean list of names, phone numbers, emails and birth dates. Club Tourism says it will never ask customers by phone, email, SMS or post for card numbers, bank details, PINs, IDs or passwords, or My Number national ID numbers. It asks members not to open suspicious links or attachments and to check anything doubtful through its shops, phone line or official site.

Members who use the same password elsewhere are advised to change it, to use a different, hard-to-guess password for each service and to switch on multi-factor authentication where they can. A customer hotline runs on weekdays and, during November, at weekends and on public holidays.

A large member file needs a smaller footprint

The scale puts this among the larger recent Japanese consumer incidents. TSN has covered Muji’s app breach, which the retailer said could involve up to 27.26 million records, and So-net’s member data breach, with 2.59 million records. Travel data has been a repeated target, as JAL’s Amadeus breach showed.

From a compliance view, the response so far follows the order Japan’s personal information law expects. A leak caused by unauthorised access has to be reported to the Personal Information Protection Commission, with a fuller report to follow, and the people affected have to be told. Club Tourism says it has made the report and will contact members. The test now is how complete and how timely the final account is, including how the attackers got in and why so many records sat on systems they could reach.

The fields involved raise a second question about data minimisation. An emergency contact, nationality and full date of birth are useful to a tour operator once a trip is booked. Held for every registered member, including those who have not travelled for years, they turn a booking site into a large store of identity data. Firms holding member files of this size can reduce the damage of the next intrusion by keeping less of that data and by deleting dormant accounts.

The defence that worked here was the separation of payment data. Because card and bank details were not in the leaked set, the harm is limited to phishing and impersonation rather than direct fraud. For members, the Club Tourism data breach mostly calls for scepticism towards any message that claims to come from the company.

The second notice is the next marker

Club Tourism has not said when its website will reopen or when it will publish its next notice. That update should show whether its investigation of the Club Tourism data breach has confirmed the 4.32 million figure and how the attackers reached the member database.

Sources

Primary:

• Club Tourism: apology and notice on a personal information leak due to unauthorised access (first notice), 31 October 2026
• KNT-CT Holdings: apology and notice on a personal information leak at a group company, 1 November 2026

Related stories

• Muji Says App Breach May Have Exposed Up to 27.26m Customer Records
• So-net Says Hack Exposed 2.59m Records and 54,401 Mail Passwords
• JAL Says Amadeus Breach Exposed Booking Data on 92,000 Customers

Image: SONIC BLOOMING / Wikimedia Commons, CC BY-SA 4.0, modified by TSN; this image is also CC BY-SA 4.0