Breach · · 3 min read
Club Tourism says details of about 4.32 million online members may have leaked
Japanese travel company Club Tourism says an intruder may have taken online members’ names, addresses, birth dates and emergency contacts. Cards and passports weren’t included.
Club Tourism is a large Japanese travel company known for package and group tours. On October 31, 2026, it said someone broke into part of its servers and that details of members of its online booking system may have leaked, about 4.32 million records. If you’ve registered as an online member with Club Tourism, here’s what it has said so far.
What happened
According to Club Tourism’s first notice (in Japanese), it detected unauthorized outside access at 5:45 a.m. Japan time on October 30, cut off communication to the affected part of its systems and started investigating. It then found that some customer information may have leaked.
The information that may have leaked belongs to people registered as internet members of its online booking system:
- name (in kanji and katakana)
- nationality and gender
- date of birth and age
- postal address and phone number
- email address
- member ID
- emergency contact details
Club Tourism says login passwords, passport details, credit card details and bank account numbers aren’t included, and that people who never registered as internet members aren’t affected. It says it hasn’t seen any specific harm caused by the incident so far.
The company says it has isolated the server, blocked the attacker’s connection, identified how they got in and fixed the problem. It has taken its website offline while it checks it is safe. It has consulted the police, reported to Japan’s Personal Information Protection Commission and its supervising authority, and says it will contact affected customers in turn. Its parent company, KNT-CT Holdings, posted its own apology (in Japanese) on November 1.
What this means for you
Your address, birth date and phone number together make it much easier for someone to pose as Club Tourism, a hotel or a tour company. The emergency contact field matters too: it may hold details of a family member or friend, who could also get scam calls or messages that use your name.
What you can do
- Be careful with calls, emails, texts and letters that claim to be from Club Tourism. The company says it will never ask for card numbers, bank details, PINs, IDs and passwords, or My Number details in connection with this incident. If in doubt, check through its store, phone line or official site.
- Let your emergency contact know, so they’re not caught off guard by a message about you or your trip.
- Change any password you reused. Passwords weren’t included, but Club Tourism suggests changing yours anywhere you used the same one, and turning on two-factor sign-in where you can.
- Use the company’s hotline if you see anything odd. Its special customer line is 0120-335-255 (weekdays 9:30 to 17:00 Japan time, and also on weekends and holidays during November).
- Learn the patterns. See how scammers use leaked data.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame’s email aliases also let you give each travel site its own address, so a leak at one doesn’t lead scammers straight to your main inbox. Frame never collects or stores the leaked records themselves.
Sources
- Club Tourism, 不正アクセスによる個人情報漏えいに関するお詫びとお知らせについて（第１信） (in Japanese), October 31, 2026
- KNT-CT Holdings, グループ会社における不正アクセスによる個人情報漏えいに関するお詫びとお知らせ (in Japanese), November 1, 2026
- NHK, クラブツーリズム 不正アクセスで約432万件の個人情報漏えいか (in Japanese), October 31, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.