Club Tourism discloses unauthorized access to 4.32 million member records

Attackers accessed online member records at Japanese tour operator Club Tourism, which detected the unauthorized external access to its servers at 5:45 a.m. Japan time on Oct. 30, 2026. It said it had confirmed the breach and took immediate action to investigate and mitigate the breach.

Club Tourism confirmed that approximately 4.32 million records tied to online booking accounts were accessed, a figure that represents total records rather than necessarily unique individuals. The company says people who never signed up as online members are not affected, and that the breach reaches only people registered in the online booking system.

Possibly exposed information includes names in kanji and katakana, nationality, gender, date of birth, age, home address, phone number, e-mail address, member ID and emergency contact details. It cut off the affected server, stopped traffic coming from the attack source, identified the intrusion route and method, and repaired the security flaw.

Club Tourism suspended its booking website, club-t.com, to prevent further damage and support its investigation. Visitors see a maintenance page, and support requests go to regional travel centers by phone. It plans to bring the site back online after its security team rechecks it.

As of Oct. 31, 2026, Club Tourism had not disclosed how the attackers entered its systems, when the intrusion began, or whether it had proof that the data was taken rather than just possibly exposed. SmartScope said on Oct. 31, 2026 that those points remain unconfirmed based on the company’s announcement. The outlet plans to revise its coverage once Club Tourism issues a follow-up notice about the intrusion route, how long it lasted, how many individuals the breach affected and when the company will notify customers, and once the site is back up and any resulting harm is known.

BigGo Finance said on Oct. 31, 2026 that attackers could use the leaked personal details to target members or impersonate them, and that people affected should stay alert. The outlet says members could face social engineering using the exposed details, even though no payment data was taken. It also said on Oct. 31, 2026 that leaving passport and payment data out of the exposed set makes the harm somewhat smaller overall. It weighs the missing payment details against the exposed personal identifiers when judging overall harm.

Club Tourism tells members to be cautious about unsolicited calls, e-mails or messages that claim to come from the company, particularly when they ask for sensitive information. The company said on Oct. 31, 2026 that it will not ask for credit card numbers, banking details, PINs, passwords or My Number in connection with this incident. My Number is Japan‘s individual identification number.

SmartScope said on Oct. 31, 2026 that possible misuse scenarios include messages about tour changes or cancellations, travel-fee refunds or membership re-registration, and that these examples have not been confirmed. It presents them as possible scenarios drawn from the exposed personal details, not as confirmed incidents.

Club Tourism recommends changing passwords on other services for members who reused their Club Tourism password, and it recommends enabling multifactor authentication. The company advises these proactive security measures even though login passwords were not compromised.

BigGo Finance said on Oct. 31, 2026 that the incident has raised questions about how travel reservation systems handle data. The outlet says the company may face accountability for governance across the group and for how it manages its systems, including work by outside contractors. It also says the suspended website could interrupt booking work and customer support.

The company said on Oct. 31, 2026 that its notice gives no sign of a shared cause or contractor with breaches at other travel or airline booking systems. The company and SmartScope both reject any link between this breach and other travel incidents.

Club Tourism told Japan’s Personal Information Protection Commission and its supervisory ministry about the breach, and it also consulted with police. The company says it has confirmed no secondary damage tied to the breach yet.

The company will notify affected customers in stages, but it has not confirmed a timeline or method, and members should wait for messages sent to the e-mail addresses they registered. The company has set up a dedicated hotline, 0120-335-255, for reporting suspicious contact or damage. The hotline is open weekdays from 9:30 a.m. to 5 p.m., with extended hours throughout November, including weekends and holidays.