Short answer
Adventure, the company behind the travel booking site skyticket, announced on 9 October 2026 that about 14.64 million customer records were affected by unauthorized access. According to ITmedia, the records were reached through three separate routes, and the company said passport numbers were not leaked.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Adventure Inc. (skyticket) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Online travel booking |
| Country | Japan |
| Detected | 2026-10-05 |
| Disclosed | 2026-10-09 |
| People or records affected | About 14.64 million customer records, about 4.13 million of them with hashed login passwords |
What data was exposed
- Names, birth dates, email addresses, phone numbers and postal addresses
- Names of bank transfer remitters
- Hashed login passwords for about 4.13 million records
- Refund bank details (bank, branch, account type, number, holder) for about 17,780 records from a separate 20 September incident
- Reservation details for about 12,000 bus bookings that could be viewed without logging in
What happened
Adventure Inc., which runs the travel booking site skyticket, said on 9 October 2026 that customer data had been exposed. NHK reported the figure as more than 14 million records that were leaked or may have been leaked. ITmedia puts the total at about 14.64 million and says it came through three separate routes rather than one break-in.
Three routes, three sets of data
The first route is the largest. ITmedia says attackers used part of skyticket’s admin function between 2 and 4 October to reach data held on other servers and in the cloud. The company found it on 5 October. This is the group with names, birth dates, contact details and bank transfer remitter names.
The second is an earlier incident on 20 September, disclosed on 28 September, involving the business management system. It covers about 17,780 records, which can include duplicates. The data here includes bank details used for refunds.
The third is not an intrusion in the usual sense. From 3 August to 1 October, bus reservation completion pages could be opened without logging in. About 12,000 reservations were visible. ITmedia says the page was fixed on 1 October.
What the company did
According to ITmedia, skyticket blocked the routes, tightened security and, on 7 October, stopped stored-card payments and saved-card registration. It emailed affected users, asked them to change passwords and said it would publish any new findings.
What is still open
The investigation into whether passport numbers were reached in the 20 September incident was still running, per ITmedia. We found no public detail on the attackers.
If you used skyticket, start with our data breach checklist. Messages that claim to be about a booking or refund fit the pattern in our guide to phishing messages, and calls that push for quick payment are covered in urgent payment scams. Other Japanese incidents from the same weeks are on the breaches index, including Lawson.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails and SMS posing as skyticket asking you to confirm a booking, refund or password.
- Calls from someone who quotes your real name, phone number or trip details and asks for card numbers or SMS verification codes.
- Fake refund messages aimed at people whose refund bank details were in the 17,780-record group.
- Credential stuffing: attackers trying your skyticket email and password on other sites if you reused them.
What to do if you are affected
- 01Change your skyticket password, and change it anywhere else you used the same one.
- 02Check your reservation history and card statements for items you do not recognize.
- 03Do not tap links in messages about skyticket. Open the official site or app yourself.
- 04Remember the company says it will not ask for passwords, card numbers or SMS codes by phone. Hang up on anyone who does.
Frequently asked questions
How many skyticket customers were affected?
Adventure reported about 14.64 million records, according to Impress Watch and ITmedia. About 4.13 million of those include login passwords in hashed form.
Were passport numbers or credit card numbers leaked?
According to Impress Watch and ITmedia, the company said passport numbers were not leaked and that it does not store full credit card numbers. For the separate 17,780-record incident, ITmedia says a passport leak could not yet be ruled out.
What is a hashed password and is it safe?
A hash is a scrambled version of the password. ITmedia notes hashed passwords can still carry risk, so changing yours is sensible, especially if you reused it elsewhere.
Has the stolen data been misused?
According to ITmedia, the company said it had not confirmed misuse of the data, while fraud such as unauthorized logins and phishing remains a risk.
Sources
- 止まらぬ情報漏えい ローソンやスカイチケット、第一興商など (Information leaks keep coming: Lawson, skyticket, Daiichikosho and others), Impress Watch, 2026-10-09
- skyticketで1464万件の個人情報流出か 413万件にはパスワードも、異なる3経路で不正アクセス (skyticket: 14.64 million records possibly leaked, 4.13 million with passwords, three routes), ITmedia @IT, 2026-10-13
- skyticket customer data report (NHK News Web, 9 October 2026), NHK, 2026-10-09
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.