ezTravel breach: contact and order details on more than 690,000 customers improperly obtained
ezTravel says an attack on its member centre on November 7, 2026 improperly obtained contact and order details for more than 690,000 customers. No card numbers or passwords were involved.
What happened
ezTravel, the Taiwanese online travel agency, said in a statement on Monday, November 9, 2026 that it detected unusual external network activity targeting its member centre on November 7 and took immediate steps to block the suspicious traffic. The company hired an independent cybersecurity team to investigate and carry out digital forensics, and reported the incident to the competent authorities and the police under Taiwan’s personal data protection rules. Its preliminary investigation found that contact details tied to some historical orders had been improperly obtained. ezTravel has notified affected customers by text message and email, and apologised for the concern caused. The company has not said how the attackers first reached the membership system, which records were confirmed taken as opposed to suspected, or whether a named group was involved, and it reported no financial losses from misuse of the data in its initial statement. This report was added on November 12, when the incident resurfaced in Taiwan’s Ministry of Digital Affairs reporting on the current wave of attacks on Taiwanese platforms; the disclosure itself is dated November 9, and the report carries that date.
Who is affected
After cross-checking and removing duplicates, ezTravel put the number of affected people at more than 690,000. The information improperly obtained is contact and order information from past bookings: names, email addresses, phone numbers, and product and order details. The company states plainly what was not involved: no credit card numbers, no card security codes, no account login passwords, no passport numbers and no national identification numbers, and payment processing was not affected. So the exposed set identifies a person, reaches them by phone and email, and knows what they booked — but it does not, on the company’s account, contain the credentials or card data that would let an attacker into the customer’s ezTravel account or charge their card directly.
How serious
The concrete risk is targeted phishing and phone fraud built on real bookings — and ezTravel itself names the scripts to expect. The company warned customers that scammers may use the stolen order details to impersonate customer-service staff or bank staff, citing excuses such as abnormal orders or duplicate charges to solicit card numbers, SMS verification codes or ATM operations, or to get customers to click malicious links. A call that quotes your actual trip, dates and order is far more convincing than a generic scam call, and the attackers’ goal in that script is the step the breach data cannot do alone: persuading you to hand over the card number, code or transfer that completes the theft. The company stressed that it will never ask customers for account passwords or verification codes, or tell them to use an ATM to cancel instalment payments, by phone, text or email — any contact doing those things is fraudulent by the company’s own definition, however much real information it quotes.
What to do now
If you receive an ezTravel notice, or have booked through ezTravel in the past, treat unexpected calls, texts and emails about bookings as unverified even when they know a real order detail: do not share card numbers or one-time codes on those channels, do not operate an ATM on a caller’s instructions, and do not click links in messages about “abnormal orders” or “duplicate charges.” On the reporting of the company’s guidance, its official notifications about this incident do not include website links — a message carrying one is a warning sign by itself. To check a booking, go to ezTravel’s official site or app yourself. Questions go to the company’s service line at 412-8001 (from a mobile phone, add 02 in front), and suspected scams can be reported to Taiwan’s 165 anti-fraud hotline. Monitoring your email and phone accounts for phishing that references your travel plans costs nothing and catches the follow-on attempts this kind of data is usually taken for.
Sources: Central News Agency (via Bitcomme), “ezTravel says credit card numbers safe after data breach,” November 9, 2026 · BreachNews, “ezTravel confirms data breach affecting 690,000+,” November 2026 (reporting ezTravel’s November 9 statement and Focus Taiwan / Central News Agency reporting)