What happened
On October 9, 2026, Adventure, Inc. (6030.T), operator of skyticket, published an apology notice about customer information leakage due to unauthorized access. There were three instances of unauthorized access that resulted in or risked personal information leakage.
Official figures
- about 14,640,000 personal information records, of which about 4,130,000 include member passwords;
- 17,780 unauthorized accesses to the operational management system (including duplicates);
- about 12,000 views of reservation information.
The company says credit card numbers and passport images were not stored or not leaked, and payments with stored cards have been suspended. It has reported to Japan's Personal Information Protection Commission and is examining the business impact.
Ask to customers
Change passwords, check reservation histories and be wary of suspicious contacts. Do not follow password-request links outside official channels.
Why it matters
Travel booking concentrates trip data and credentials. Even without card or passport data, email + password (if reused) and reservation details enable targeted phishing.
What to do now
- skyticket users: change your password and enable MFA where available.
- Travel companies: keep operational management systems off the public internet and monitor bulk reservation access.
- Treat "may have leaked" as a breach until the final count is out.