Club Tourism says possible leak affects 4.32 million online member records
Published · Updated
What happened
Club Tourism disclosed a possible personal-data leak involving about 4.32 million internet reservation system member records after unauthorized external access. The company suspended its website and notified police and the Personal Information Protection Commission.
Why it matters
The case is large by Japanese consumer-services standards and puts immediate focus on incident reporting, customer notification, and regulatory follow-up under Japan's privacy rules. It can also interrupt bookings and payments at a travel operator that handles sensitive personal and itinerary-linked information.
Club Tourism announced on October 31 that unauthorized external access may have exposed data on about 4.32 million users of its internet reservation system. The company said the affected information can include names, nationalities, gender, birth dates, addresses, phone numbers, email addresses, member IDs, and emergency contact details, and that it has suspended its website. It also said it reported the incident to police and to Japan's Personal Information Protection Commission.
Watch for
Club Tourism notice by 2026-11-03 specifying whether payment-card data or passport-related booking data were included Personal Information Protection Commission statement by 2026-11-03 on whether it has opened a formal administrative review into Club Tourism's handling Kintetsu Group Holdings disclosure by 2026-11-03 on service disruption, booking suspension scope, or groupwide security measures following the incident Club Tourism update by 2026-11-03 on phased website restoration or continued reservation-system shutdown
Sources
Researched and written by AI from the sources listed, under published rules. How V³ Aware is made