Club Tourism breach: personal information of about 4.32 million online members may have leaked
Club Tourism announced on October 31, 2026 that unauthorized access to part of its servers may have leaked personal information of about 4.32 million online members — names, nationality, gender, date of birth and age, addresses, phone numbers, email addresses, member IDs and emergency contacts; login passwords, passport, credit card and bank account details were not included, the company said.
What happened
Club Tourism, a major Japanese travel agency and a group company of KNT-CT Holdings, announced on October 31, 2026 that unauthorized access from outside to part of its servers may have leaked personal information held in its internet reservation system. The company detected the unauthorized access at 5:45 a.m. on October 30, 2026 and began an investigation, which confirmed the possibility that information had been leaked. The company isolated the affected servers, blocked communications from the source of the attack, and says it has identified the intrusion route and method and is taking corrective measures. It has suspended its website while the investigation continues and will resume it once safety is reconfirmed. Club Tourism says it has consulted the police and reported the incident to Japan’s Personal Information Protection Commission and the relevant supervisory authorities, and that it will contact users whose information may have been leaked in sequence. The company has not said that data was confirmed taken — its wording is that a leak is possible — and no specific secondary damage had been confirmed in its first notice.
Who is affected
People registered as online (internet reservation) members of Club Tourism — approximately 4.32 million member records. The information that may have leaked is: names (in kanji and kana), nationality, gender, date of birth and age, address, telephone number, email address, membership ID, and emergency contact information members registered. The company says login passwords, passport information, credit card and other payment information, and bank account numbers were not included, and that people who have never registered as online members are not affected. The emergency-contact details belong in many cases to a different person from the member — a relative or other contact the member named.
How serious
The concrete risk is targeted phishing and scam calls, not card fraud: no payment card data or passwords were included, on the company’s account, so this data alone does not hand an attacker a usable card or a Club Tourism login. What it does hand over is a convincing script — a scammer who knows your name, address, phone number, email and travel-agency membership can pose as Club Tourism, and a scammer who also has your emergency contact’s name and number can call that person with a story built around you. Club Tourism itself warns customers to be cautious of suspicious phone calls, emails and SMS messages, and says it will never ask for credit card numbers, bank account information, PINs, IDs or passwords, or Japan’s My Number identification number.
What to do now
Treat any call, email or text claiming to be Club Tourism and asking for card numbers, bank details, PINs, passwords or your My Number as a scam, however much real information the caller knows — reach the company only through its official channels, which you open yourself. If you listed an emergency contact on your Club Tourism membership, tell that person yourself: their name and phone number are in the possibly leaked data, the company’s notices go to members, and a scammer who knows both of you can call them with a convincing story. Watch for a further notice from the company — it says it will contact affected users in sequence and is still reviewing the scope of the impact. If you never registered as a Club Tourism online member, the company says you are not affected and no action is needed.
Sources: TRAICY Global, reporting the Club Tourism notice, October 31, 2026 · BigGo Finance, reporting the company announcement, October 31, 2026 · Japan Cyber Watch, breach-notice guidance, November 1, 2026