skyticket (Adventure Inc.) data breach
Was I affected?
skyticket (Adventure Inc.) confirmed a breach involving up to 14.6 million records (duplicates possible), exposing names, dates of birth, email addresses and phone numbers. You may be affected if you have a skyticket account or entered your details on skyticket to book flights, hotels or buses, especially if you asked for a refund to a bank account or booked a bus between August and October 2026.
| Announced | Oct 9, 2026 |
|---|---|
| When it happened | Three incidents between August 3 and October 4, 2026 |
| Country | Japan |
| Records exposed (may include duplicates) | 14.6 million |
| Data exposed | Names, Dates of birth, Email addresses, Phone numbers, Addresses, Passwords, Bank or financial details and Other details |
| Status | Confirmed by the company or a regulator filing |
What happened
Adventure Inc., which runs the Japanese travel booking site skyticket, said on October 9, 2026 that it had found three separate incidents. In the largest, attackers misused part of skyticket's admin functions between October 2 and 4 to reach data on other servers and in the cloud, exposing about 14.64 million customer records: names (including passport spellings), dates of birth, email addresses, phone numbers, postal addresses, bank-transfer payer names and, for about 4.13 million, hashed login passwords. A September 20 attack on a business system exposed 17,780 records (duplicates included) with refund bank account details, and a bus booking page viewable without login from August 3 to October 1 exposed about 12,000 bookings. Card numbers and passport images are not stored and were not affected, and passport numbers were not leaked in the largest incident.
What should I do?
- Change your skyticket password, and change it on any other service where you used the same one.
- Check your skyticket booking history and card statements for bookings or charges you don't recognize.
- If you gave a bank account for a refund, watch it for unfamiliar deposits or debits, and never give your PIN or online banking codes to callers claiming to process a refund.
- Be wary of emails, texts or calls posing as skyticket, airlines or bus companies that quote your real booking details and ask for payment or changes.
Check the other services you use →
Sources
- 不正アクセスによるお客様情報の流出に関するお詫びとお知らせ (Notice and apology regarding customer data leak) · Adventure Inc. (in Japanese) · official
- 格安航空券比較・予約サイト「skyticket」で3件の不正アクセス、1400万件超の個人情報が流出し、1件の悪用も確認 (Three intrusions at skyticket; over 14 million records leaked) · INTERNET Watch (in Japanese) · news
- スカイチケットで情報流出 不正アクセス1464万件 (skyticket leak: 14.64 million records) · Hokkaido Shimbun (in Japanese) · news
- skyticketで1464万件の個人情報流出か 413万件にはパスワードも、異なる3経路で不正アクセス (14.64 million records may have leaked; 4.13 million with passwords) · ITmedia @IT (in Japanese) · news