Short answer
Club Tourism said on 31 October 2026 that it detected unauthorized external access to part of its servers at 5:45 a.m. on 30 October and that about 4.32 million internet member records may have leaked. The company said passwords, passport data, card information and bank accounts were not included.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Club Tourism |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Travel agency |
| Country | Japan |
| Detected | 2026-10-30 |
| Disclosed | 2026-10-31 |
| People or records affected | About 4.32 million internet member records |
What data was exposed
- Full name in kanji and kana, nationality, gender, date of birth and age
- Address, phone number and email address
- Member ID and emergency contact details
What happened
Club Tourism, a Japanese travel company known for group tours, published a first report on 31 October 2026. It says unauthorized external access to part of its servers was noticed at 5:45 a.m. on 30 October. The company then confirmed that some customer information it holds may have leaked. ScanNetSecurity covered the notice on 6 November.
What was exposed
The affected group is people registered as internet members in the online booking system, about 4.32 million records. The data items are full name in kanji and kana, nationality, gender, date of birth and age, address, phone number, email address, member ID and emergency contact details. The notice says login passwords, passport information, credit card information and bank account numbers were not included. The figure is approximate.
The emergency contact field matters. It means a second person, who may never have used the service, may have had their details taken too.
What the company did
According to the notice, Club Tourism blocked the compromised access points and the attack source, isolated the affected server, and began fixing the problems it found while checking the scope and looking for similar incidents. It temporarily suspended its website and said it would resume once safety is confirmed. It reported the incident to the police, the Personal Information Protection Commission and the relevant regulators, and will notify affected customers in sequence.
What is not yet known
The notice and ScanNetSecurity do not give the root cause or entry method; the company said it was identifying them. We found no public claim by an attacker. No specific secondary damage had been confirmed at the time of the first report.
What the company asks of customers
Be careful with calls, emails, SMS or mail that claim to come from the company. It says it will never ask for card numbers, bank details, PINs, IDs or passwords, or My Number in connection with this incident. Do not open suspicious links or attachments. If in doubt, check through a store, the phone line or the official site. The dedicated line is 0120-335-255, open weekdays 9:30 to 17:00 and also on weekends and holidays during November.
Travel details give scammers a good story, which is why our guide to travel and holiday booking scams is worth a read, along with phishing messages. Our data breach checklist covers next steps, and another Japanese travel incident is covered in skyticket. The full list is on the breaches index.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake Club Tourism emails, SMS or calls about a tour, refund or account check that ask for card or bank details.
- Messages that mention a real trip or your emergency contact to seem genuine.
- Calls to your emergency contact claiming you have had an accident or need money.
- Phishing links that copy the company's suspended website login.
What to do if you are affected
- 01If a message says it is from Club Tourism, do not use its links. Verify through a store, the phone line or the official site.
- 02Remember the company says it will never ask for card numbers, bank details, PINs, passwords or My Number in connection with this incident.
- 03If you reused your Club Tourism password elsewhere, change it and turn on multi-factor authentication where available.
- 04Warn the person you listed as an emergency contact to be wary of urgent calls about you. Contact the dedicated line, 0120-335-255, if you see signs of misuse.
Frequently asked questions
How many people are affected?
About 4.32 million internet member records, according to the company's first report. Only people registered as internet members are affected, not people who never registered.
Were passport numbers or card details leaked?
The notice lists login passwords, passport information, credit card information and bank account numbers as not included.
Is the Club Tourism website down?
The company temporarily suspended its website to prevent further damage and support the investigation, and said it would resume once safety is confirmed.
Has the data been misused?
The company said no specific secondary damage linked to the incident had been confirmed at the time of the first report.
Sources
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.