Club Tourism breach may have leaked 4.32M records

What the Club Tourism breach may have exposed

About 4.32 million online member records may be affected, covering contact details and emergency contacts but not passwords or payment data. Club Tourism, a major Japanese travel agency in the KNT-CT Holdings group, said on October 31, 2026 that some customer information may have leaked after an outsider gained unauthorized access to part of its servers. The company labeled it a first notice.

The records belong to people who registered as internet members, meaning they created an account on Club Tourism's online booking system to reserve tours. The figure counts records that may have leaked, not confirmed losses.

Earlier in October, another Japanese travel booking service reported a much larger leak (related: Skyticket data breach: 3 incidents, up to 14.64M). For other incidents announced by Japanese companies, see the running list (related: Japan data breach list: cases by date and cause).

Nine types of member data, including emergency contacts

The list goes beyond the member's own name and address to nationality and an emergency contact, so family members listed there may also be affected. Club Tourism named nine types of data.

Data that may have leaked (from Club Tourism's notice)

Group	Data
Identity	Name (in kanji and kana), nationality, gender, date of birth and age
Contact details	Address, phone number, email address
Account	Member ID
Someone else	Emergency contact

An emergency contact is the person a traveler names to be reached if something happens during a trip, usually a family member. The notice does not say whether that field holds only a name and phone number or more. It also does not mention booking history or travel itineraries.

Passwords, passports and card numbers are not included

Club Tourism says bank account numbers are also excluded, and people who never signed up as internet members are not affected. The company listed four kinds of data that were not part of the leak:

• Login passwords
• Passport information
• Credit card information
• Bank account numbers

If you booked a Club Tourism tour only at a store or by phone and never created an online account, your data is not part of this incident. The leak covers only people who signed up for the online booking system.

How Club Tourism responded after detecting the access

The company says it has found and fixed the entry point, but its website remains offline with no date for a return. Club Tourism spotted the unauthorized access at 5:45 a.m. on October 30. It started investigating right away and cut off network traffic to the affected systems.

The investigation then showed that part of its customer information may have leaked. To stop further damage and support the investigation, the company took its website offline. It says the site will come back once the company has confirmed it is safe, but has not given a date.

Server isolated and the entry route identified

Club Tourism has not said how the attackers got in or who was behind the access. The company isolated the server that was accessed and blocked traffic from the source of the attack.

It also identified the entry route and the method used, fixed the problems it found, and checked how far the damage reached and whether anything similar had happened elsewhere. Club Tourism has consulted the police and reported the incident to Japan's Personal Information Protection Commission and its supervising ministry.

The booking site and My Page are offline

Members cannot check documents for web bookings or pay by card online while the booking site shows a maintenance page. As of November 2, the homepage of club-t.com shows a system maintenance notice instead of the usual booking pages.

According to that notice, My Page, the account area where members manage bookings, is unavailable along with credit card payment. The notice apologizes for the leak and points visitors to the corporate site for details.

What Club Tourism members should watch for

No misuse had been found when the notice went out, but Club Tourism will contact affected members in turn, so members need to tell real messages from fake ones. As of its first notice, the company said it had not confirmed any harm resulting from the incident.

On November 1, Club Tourism posted a second warning after receiving reports of suspicious emails and text messages that used its name or the names of its staff. If you get a message you do not recognize, the company asks you to delete it without tapping the link or opening any attachment.

Club Tourism will not ask for card numbers or passwords

Any email that asks you to restore or confirm your member information, or to enter card details, is a scam even if it carries the Club Tourism name. The company says it will never ask for the following by phone, email, text or post in connection with this incident:

• Credit card numbers
• Bank account details
• PINs
• IDs and passwords
• My Number, Japan's national ID number

Club Tourism also says it does not send emails, texts or LINE messages that lead to a page asking for passwords, login details or card information. If you are unsure whether a message is genuine, check with a Club Tourism store, its phone line or its official website.

If you used your Club Tourism password on other services, the company suggests changing it. It also recommends turning on multi-factor authentication, which asks for a second check such as a code sent by text, wherever a service offers it.

Where members can call in Japan

The dedicated hotline is 0120-335-255, toll-free in Japan, and in November it also takes calls on weekends and holidays from 9:30 to 17:00 Japan time. Club Tourism set up the line for members who receive suspicious messages or suspect they have been harmed because of the incident.

Club Tourism hotline (from the company's notice)

Line	Number	Hours (Japan time)
Club Tourism customer hotline for this incident	0120-335-255 (toll-free in Japan)	Weekdays 9:30 to 17:00; in November also Saturdays, Sundays and holidays

Call the number published in the notice, not one that appears in an email or text. A number in a fake message may lead to the scammers rather than the company.

What travel companies and members can learn

IPA asks businesses to check logs on public-facing systems and cut the data they keep, and asks individuals to treat unexpected emails and texts as scams and delete them. IPA, Japan's government-backed information security agency, says Japanese companies have recently announced a string of leaks caused by unauthorized access. It issued a notice for businesses on October 9 and guidance for individuals on October 26.

In this case, an outsider reached a server holding millions of member records. That leaves both sides with something to review: companies that keep member data in online systems, and the members who signed up.

Travel companies: check logs on public-facing systems

IPA advises checking logs of public-facing applications from the last month onward and keeping only the personal data you actually need. According to IPA, recent cases suggest that intrusions start with compromised internet-facing applications and services, or with compromised accounts.

Companies that run their own booking sites or member pages can start by listing every such system. Then look through the logs for anything unusual, such as a jump in errors, first over the last month and then over the last three months. Deleting data you no longer need, such as records of members who stopped using the service, shrinks what can leak if someone does get in.

Members and families: delete unexpected emails and texts

IPA warns that leaked names, addresses and phone numbers can be used in fake emails and scam calls, and that the fake message may even include your name. Leaked details can be gathered into lists and sold on the dark web.

IPA advises treating any unexpected email or text as a scam and deleting it without tapping the link. Because addresses are in the data, refuse cash-on-delivery parcels you did not order. If you listed a family member as your emergency contact, pass the same warning on to them.