Taiwanese online travel agency ezTravel (易遊網) says an external cyberattack on its membership system exposed contact and order information belonging to more than 690,000 customers.
In a statement released on November 9, 2026 and reported by Focus Taiwan and Central News Agency, the company said it detected unusual external network activity targeting its member center on November 7. It blocked the suspicious traffic, retained an independent cybersecurity team for investigation and digital forensics, and reported the incident to the competent authorities and police under Taiwan’s personal data protection rules.
What data was accessed
ezTravel said a preliminary review found that contact details tied to some historical orders were improperly obtained. After cross-checking and removing duplicates, the company put the number of affected people at more than 690,000. The exposed information may include:
- Names
- Email addresses
- Phone numbers
- Product and order details from past bookings
The company said the incident did not involve credit card numbers, card security codes, account login passwords, passport numbers or national identification numbers, and that payment processing was not affected.
Customer warnings
ezTravel said it has notified affected customers by text message and email. It warned that scammers may use stolen order details to impersonate customer service or bank staff, citing excuses such as abnormal orders or duplicate charges to solicit card numbers, SMS verification codes, ATM operations or clicks on malicious links.
The company stressed that it will never ask customers for account passwords or verification codes, or tell them to use an ATM to cancel installment payments, by phone, text or email. Official notifications about this incident do not include website links, according to local reporting of the company’s guidance. Customers with questions can call ezTravel’s service line at 412-8001 (add 02 from a mobile phone) or Taiwan’s 165 anti-fraud hotline.
What has not been disclosed
As of publication, ezTravel had not published a standalone English incident page on eztravel.com.tw that could be linked directly. It has not said how the attackers first reached the membership system, which records were confirmed versus suspected, or whether a named threat group was involved. No financial losses from misuse of the exposed data had been reported in the company’s initial statement.
Travel and booking platforms have been a recurring target for customer-data theft. BreachNews previously covered the Amadeus booking platform breach affecting major airlines and the Air Creebec breach exposing employee and passenger files.
What affected customers should do
Anyone who receives an ezTravel notice should treat unexpected calls, texts or emails about bookings with skepticism, even if the sender knows a real order detail. Do not share card numbers or one-time codes over those channels. Monitor email and phone accounts for phishing that references travel plans, and report suspected scams to the 165 hotline or ezTravel’s official support line.
