H.I.S. (HIS) announced that H.I.S. TOURS, its local subsidiary in Thailand, was subject to unauthorized access by a third party, potentially resulting in the leak of personal information.
On December 11, 2025, unauthorized access detection software installed on the Thai subsidiary’s file server issued an alert. An investigation involving external experts found that some data on the file server may have been improperly extracted. On December 29, the company confirmed that the server contained some personal information collected in Japan and reported the matter to Japan’s Personal Information Protection Commission and the Japan Institute for Promotion of Digital Economy and Community (JIPDEC). On February 24 this year, it was determined that the data included passport information for up to 627 people.
The information that may have been leaked includes passport details (name in Roman alphabet, name in the signature field, gender, date of birth, passport number, and expiration date) and allergy information. Those affected are people who traveled from Japan to Thailand using HIS services in 2017, from 2019 to 2020, and from 2024 to 2025. The data did not include telephone numbers, addresses, email addresses, or credit card information.
HIS explained that the announcement took time because the server contained a large volume of data, including accounting records unrelated to personal information, in a wide variety of file formats and storage conditions. As mechanical processing and searches were not possible, each item of data had to be carefully reviewed and cross-checked, including through manual work. The company will contact affected customers individually where contact details can be identified, while disclosing the matter on its website for those whose identities are difficult to determine.
The company said it will work to strengthen security overseas and tighten its system monitoring framework managed by its headquarters.
