Skyticket data breach: 3 incidents, up to 14.64M

Unauthorized access in 3 incidents put personal data of 14.64M at risk

Adventure found three unauthorized access incidents at Skyticket, and the biggest one alone covers about 14.64 million records. That figure is not a total. Each incident is counted differently: incident 1 counts customers who registered or entered data, incident 2 counts records including duplicates, and incident 3 counts bus reservations.

"Three unauthorized access incidents at Skyticket" puts the three side by side. Incident 2 was the first to be found, on September 28, even though incident 3 had started earlier.

Three unauthorized access incidents at Skyticket (from Adventure's notice)

Incident	When it happened	Records
1. Company servers	October 2–4 (found October 5)	about 14.64 million
2. Business management system	September 20 (found September 28)	17,780 (with duplicates)
3. Bus booking service	August 3 – October 1 (found October 1)	about 12,000 reservations

The same week, karaoke chain operator Daiichikosho also disclosed a possible leak at a contractor. We covered it in Big Echo data breach: 8.72M records may be exposed.

Admin hack leaked date of birth and hashed password data

Incident 1 is the largest: about 14.64 million records of people who registered or entered details on Skyticket. Between October 2 and 4, an outsider misused part of the site's admin functions, the screens staff use to run the service. From there the attacker reached data Adventure kept on other servers and in the cloud.

The leaked items are name (including passport spelling), date of birth, email, phone number, postal code and address, and the name used for bank transfers. About 4.13 million records also hold a member login password.

The passwords were hashed, meaning stored in a form that is hard to turn back into the original. Adventure still warns that analysis could reveal them.

Vulnerability exposed bank account number details in 17,780 records

Incident 2 hit the business management system on September 20 through a vulnerability, a weak spot in how the system was built or set up. It was found on September 28. The 17,780 records include duplicates, and Adventure is still counting some others.

Names and phone numbers were exposed along with refund bank details: bank, branch, account type, bank account number and account holder. A few records also carry email and date of birth (68) or address (18).

Bus booking flaw let outsiders see personal data in 12,000 bookings

Incident 3 involved bus booking confirmation pages that anyone could open without logging in. An outsider ran an automated tool against them between August 3 and October 1. Adventure found the problem on October 1 and fixed it that day.

The roughly 12,000 figure counts reservations, not people. Adventure says more people are affected once travel companions are included.

Credit card information and passport number not leaked

The leaked items differ by incident. The October 9 notice said credit card information was not exposed in any of them, but a later investigation found card numbers, names and expiry dates of up to 6,140 members leaked (reported by NHK and others on October 17, 2026). Incident 1 is mostly account details, incident 2 is refund bank data, and incident 3 is trip details. "Data leaked or viewed in each incident" lists what each one covered.

Data leaked or viewed in each incident (from Adventure's notice)

Incident	Main items
1 (about 14.64 million)	Name incl. passport spelling, date of birth, email, phone, postal code and address, bank transfer name, hashed login password
2 (17,780)	Name, phone, refund bank details (bank, branch, account type, account number, holder); some email and date of birth (68), address (18)
3 (about 12,000 reservations)	Booker name (katakana), age, gender, date of birth if registered, email, phone, member ID, payment method and amount, booking time, trip details, companions' name, age and gender

The October 9 notice said Adventure does not keep card numbers and that a payment processor holds them. A later investigation found past records that still held card data, and up to 6,140 members' card numbers, names and expiry dates were leaked (reported October 17, 2026).

Passport images are not stored either, so they could not leak. Adventure confirmed that passport numbers did not leak in incident 1, although passport spellings of names did. For incident 2, no passport number leak has been found so far, and the company is still checking.

Saved credit card information payments halted after security breach

Adventure cut off the access routes and, around 6 p.m. on October 7, stopped payments with saved credit cards. The goal is to keep anyone who logs in to a member account from buying with the card stored there. The feature for saving new card details is also off, and the company is fixing the vulnerability.

Emails to affected customers have gone out in turn since around 7 p.m. on October 8, sent from info@skyticket.com. Customers who do not get one should treat the public notice as their notification. Adventure has also reported the breach to Japan's Personal Information Protection Commission.

Personal data misuse limited to unauthorized access of one account

The only confirmed misuse so far is an unauthorized login to one member account, found on September 9. Adventure disclosed it with incident 2 and says no other harm had been confirmed when it published the notice. It lists four kinds of harm that could follow:

• Scam emails, texts, calls or letters posing as Adventure, banks, airlines or bus companies
• Logins to Skyticket or other services using cracked passwords
• Calls posing as refunds that try to get bank PINs or online banking logins
• Messages asking to change a bus booking or pay an extra fee

Change password and watch for phishing email after the data breach

Skyticket members should change their password, and also change it anywhere else they use the same one. Adventure says to do this directly on the skyticket website or in the app, because its own emails never include a link asking for a password.

Customers should also check their booking history in My Page and their card statements, and watch for suspicious messages posing as the company or a bank. Adventure says it will never ask for passwords, card numbers or bank PINs, and will not ask anyone to pay money over this incident.

Questions go to info@skyticket.com. The October 8 notice gives the hours as daily, 10:00 to 18:00 Japan time, and Adventure has not published a phone line. The company says it is still investigating and will post any new findings.