Adventure Inc. announced that unauthorized access to its travel booking website, “skyticket,” may have resulted in the leakage of bank account information for refunds, as well as certain credit card information and information related to travel insurance applications.
The refund bank account information affects users who registered an account for refunds or other purposes between March 1, 2022, and May 2024, totaling 32,341 records. The information includes the financial institution name, account type, account number, and account holder name (in katakana). It does not include names (in kanji), addresses, email addresses, telephone numbers, PINs, or internet banking IDs and passwords.
The credit card information affects some users who made card payments between approximately May 2021 and mid-May 2024, totaling approximately 936,000 records (approximately 414,000 individuals). The information includes the cardholder name, partially masked card numbers (either only the last four digits, or the first six and last four digits), and browser information. It does not include full card numbers, expiration dates, or security codes. However, in 12 cases, card numbers had been entered in the cardholder name field and were therefore recorded in full.
Information related to travel insurance applications affects applicants for domestic travel insurance in Japan (applications made from September 2023 to May 2024) or cancellation insurance (applications made from January to May 2024), as well as insured persons under domestic travel insurance. The total is approximately 118,000 records (approximately 119,000 individuals). The information includes the policyholder’s name (in katakana), date of birth, gender, mobile phone number, email address, member ID, and booking details (flight number, travel date, route, and travel price), as well as the insured person’s name (in katakana), date of birth, and gender.
Adventure explained that it had retained a copy (backup) of a previously acquired database in the cloud without deleting it after it was no longer needed. Credentials obtained during unauthorized access between October 2 and 4 were misused to access part of this copy. The company confirmed that the portion containing bank account information was transmitted externally. While there is no evidence that the other portions were transmitted, the possibility cannot be ruled out. Bank account information and the name fields in the travel insurance data should originally have been stored in encrypted form, but were stored without encryption.
The company has revoked the permissions associated with the fraudulently used credentials and made the database copy inaccessible. The copy is scheduled to be deleted after the investigation is complete. Adventure has reported the matter to its payment processing company and requested that card issuers monitor the 12 cases in which full card numbers were recorded for fraudulent use. It has also reported the incident to the insurance companies underwriting the travel insurance policies.
To determine the full scope of the incident, the company is preparing to conduct a digital forensic investigation by an external specialist investigation firm.
