What happened
On October 9, 2026, Resorttrust, a Japanese operator of membership hotels and resorts (with brands such as Baycourt Club and XIV) that also runs health services for members, disclosed that unauthorized access to its website led to a leak of personal data:
- about 26,000 group member records;
- about 36,000 reservation records for The Kahala Hotel & Resort Yokohama.
What did not leak
According to the notice, the data does not include usage history, medical information, credit card data, bank accounts, email addresses or identity documents. That matters because the group also works in health checkups, where a leak would be far more serious.
In its investor disclosure, the company did not publicly detail exactly which fields were exposed or how the attackers got in. The investigation continues.
The company's response
- Working with outside security specialists to find the cause.
- Fixing the vulnerability in affected systems, stronger monitoring and a review of access privileges.
- Individual contact with those affected, with an apology and explanation.
- Rebuilding its information security framework across the group.
- The financial impact is still unknown and will be disclosed if it emerges.
Context: a rough week in Japan
The case joins a run of leaks announced in Japan in early October, including Lawson, Bookoff, skyticket and the ransomware at IDC Frontier's cloud. A common pattern: customer-facing sites and apps, exposed to the internet, with flaws that let attackers pull data in bulk.
What customers should do
- Be wary of emails, texts and calls that mention your booking or membership, even with correct details. Leaked data is used for convincing scams.
- Confirm any contact through the company's official channels.
- Never give a password or card details over the phone or via a link you received.
Lessons for businesses
- Inventory everything exposed to the internet: booking sites, member areas, legacy systems.
- Run regular penetration tests on web applications, not just the network.
- Apply least privilege: the website shouldn't be able to read entire customer databases.
- Keep enough access logs to quickly answer "what left, and whose was it."
Sources
- Japan IR, Resorttrust disclosure (Oct 9, 2026): https://japanir.jp/en/company/company-4681/ir/4681-20261009-01_wp_disclosure_update/
Need to review the security of your websites and customer systems? KGA IT offers a free consultation: kga-it.com.