Japanese tour operator Club Tourism has confirmed that attackers broke into part of its server environment and may have taken personal information tied to about 4.32 million online booking accounts. The company, a subsidiary of Tokyo-listed KNT-CT Holdings, detected the intrusion at 5:45 a.m. Japan time on October 30, 2026, and has taken its travel booking website offline while it investigates.
Club Tourism disclosed the incident on October 31 in a notice labeled as its first update, and KNT-CT Holdings published its own apology on November 1. Both describe “unauthorized access from outside” to “part of” the company’s servers, followed by the possible leak of customer information held in its internet reservation system.
Nine data fields from online member profiles
According to the official Club Tourism notice, the affected records belong to people registered as internet members of its online booking system. The company lists the following fields as possibly leaked:
- Full name, in kanji and katakana
- Nationality
- Gender
- Date of birth and age
- Home address
- Phone number
- Email address
- Member ID
- Emergency contact details
Club Tourism says login passwords, passport information, credit card data and bank account numbers were not included. Customers who never registered as internet members are not affected, according to the notice.
Emergency contacts widen the circle
The emergency contact field matters because it can hold information on people who never signed up with Club Tourism at all. Travelers usually list a spouse, child or other relative as the person to call if something goes wrong on a trip. The notice does not say which emergency contact details were stored, but those relatives could now receive scam calls or messages that use real names and trip context to sound convincing.
Combined with dates of birth and home addresses, the exposed fields are well suited to targeted fraud such as fake refund offers or bogus tour cancellation notices.
Booking site in maintenance mode
The company says it isolated the affected server, cut off traffic from the attack source, identified the intrusion route and method, and fixed the underlying problem. It has suspended its website to prevent further damage and support the investigation, and says it will bring it back once it reconfirms the site is safe.
As of November 1, the club-t.com travel site shows a maintenance page. My Page accounts, online credit card payments and document checks for web bookings are unavailable, and the company is directing travelers to its regional travel center phone lines. Club Tourism also told subscribers to its Club Tourism PASS plan whose annual renewal fell on November 1 that the fee would still be charged and refunded later.
Police and regulators notified
Club Tourism says it has consulted the police and reported the incident to Japan’s Personal Information Protection Commission and its supervisory ministry. The company says it will contact affected customers in stages and has not confirmed any specific secondary damage linked to the incident so far.
KNT-CT Holdings said in its November 1 release that it will further strengthen oversight of its group companies.
Gaps in the first update
The notice leaves several key questions unanswered. Club Tourism has not said how the attackers got in, when the intrusion began, or whether it found evidence that data was actually copied out, as opposed to a possible leak. The 4.32 million figure is a count of records, and the company has not said how many individual people it represents. No ransomware or extortion group has publicly claimed the attack, and Club Tourism has not attributed it to any group.
Japan’s run of large consumer breaches
The disclosure lands days after Sony Network Communications confirmed a So-net breach affecting 2.58 million records. Japanese travelers were also caught up in the Amadeus breach that exposed booking data of JAL and ANA passengers, and travel platforms remain a frequent target, as the Booking.com reservation data breach showed. There is no public evidence linking these incidents to Club Tourism.
What Club Tourism is asking members to do
- Treat calls, emails, SMS and letters claiming to be from Club Tourism with caution. The company says it will never ask for card numbers, bank details, PINs, passwords or My Number information in connection with this incident.
- Do not click unfamiliar links or open attachments, and confirm any message through a Club Tourism branch, phone desk or the official website.
- Change your password on other services if you reused your Club Tourism password, and turn on multi-factor authentication where possible.
- Report suspicious contact or related damage to the dedicated hotline at
0120-335-255, open 9:30 a.m. to 5 p.m. on weekdays and, throughout November, on weekends and holidays.
Members who listed a family member as an emergency contact should warn that person as well. BreachNews has a guide on how to respond when you receive a data breach notification.
