Japanese travel company Club Tourism has disclosed a cyberattack that potentially exposed personal information belonging to approximately 4.32 million internet-member records. The compromised data may include names, addresses, telephone numbers, email addresses, birth dates, nationalities, membership IDs and emergency-contact information. Although unauthorized access was confirmed, investigators have not determined how many records were actually stolen.
ATTACK DETECTED AND SERVERS ISOLATED
Club Tourism discovered unauthorized access on October 30 and immediately isolated the affected server, blocked attacker communications and launched an investigation. The company identified and corrected the intrusion issue but has not disclosed the attack method or vulnerability involved. Several website services, including account access, online reservations and credit-card payments, were temporarily suspended while security checks continued. Club Tourism also notified Japanese authorities, including police and the Personal Information Protection Commission.
PASSWORDS AND PAYMENT INFORMATION NOT EXPOSED
According to Club Tourism, the potentially compromised records do not include login passwords, passport information, payment-card details or bank-account numbers. However, exposed personal information could enable phishing campaigns, identity impersonation and fraudulent travel-related communications. Cybercriminals could exploit customer details to create convincing messages involving reservations, refunds or account verification. Customers should avoid suspicious messages requesting sensitive information and verify communications directly through official company channels.
CUSTOMERS URGED TO REMAIN VIGILANT
Club Tourism has warned customers about potential impersonation attempts involving its brand. Members should monitor suspicious emails, telephone calls and text messages while notifying individuals listed as emergency contacts about possible exposure. Security experts recommend strong authentication, monitoring unusual account activity and avoiding unsolicited requests for personal information. The company continues investigating the breach, and the full extent of data exposure remains unknown.