Club Tourism announced that some of the personal information it holds may have been exposed externally after part of its servers were subject to unauthorized access from outside.
The company detected the unauthorized access at 5:45 a.m. on October 30 and began an investigation. It blocked communications to the affected areas and implemented security measures. A subsequent investigation confirmed the possibility that information had been leaked.
The potentially affected data relates to approximately 4.32 million people registered as online members. The information includes names (in kanji and kana), nationality, gender, date of birth and age, address, telephone number, email address, membership ID, and emergency contact information.
The data does not include login passwords, passport information, credit card information, or bank account numbers. The company said that people who have never registered as online members are not affected.
Club Tourism isolated the affected servers and blocked communications from the source of the attack. It has also identified the intrusion route and method and is taking corrective measures, including fixing the issues and reviewing the scope of the impact. To prevent further damage and conduct the investigation, the company has currently suspended its website and will resume it once safety has been reconfirmed. It has also consulted the police and reported the incident to Japan’s Personal Information Protection Commission and the relevant supervisory authorities. Users whose information may have been leaked will be contacted in sequence.
Club Tourism is urging customers to be cautious of suspicious phone calls, emails, and SMS messages, stating that it will never ask for credit card numbers, bank account information, PINs, IDs or passwords, Japan’s My Number identification number, or similar information.
