Breach · 3 min read
ezTravel: contact details from past orders of more than 690,000 customers were reached
Taiwan’s ezTravel says an attack on its member centre on November 8 reached names, emails, phone numbers and old order details. It says cards, passwords and ID numbers were not taken.
Online travel agency ezTravel (易遊網) says an abnormal external attack on its member centre on Saturday, November 8, 2026 reached contact information tied to historical orders for more than 690,000 customers. Taipei Times reported the company’s statement on November 9.
What happened
ezTravel says it detected the attack, activated its incident response, and blocked the abnormal traffic. It has hired a third-party cybersecurity team for forensics and has reported the incident to the competent authorities and police within the legal timeframe under Taiwan’s personal data rules.
After removing duplicates, the company puts the number of affected customers above 690,000. The data that may have been reached includes names, email addresses, phone numbers and product order information from historical records.
What was not taken
According to the company, the incident did not compromise credit card numbers, security codes or account passwords, and did not leak passport or national ID numbers. It says the security of financial transactions remains unaffected on that basis.
What this means for you
Order history plus a name and phone number is enough for a convincing “abnormal order,” “duplicate charge” or “refund” call. ezTravel warned that scam rings may impersonate customer service or bank staff and ask for card details, SMS codes, ATM steps or malicious links. The company says it will never ask for account passwords or verification codes, or tell you to use an ATM to cancel installments, by phone, text or email.
What you can do
- Read the SMS or email notice from ezTravel if you received one, then ignore follow-ups that ask for codes or card numbers.
- Do not confirm a password, SMS code or card detail with anyone who contacts you about an “abnormal order,” even if they recite a past trip.
- Check recent bank and card statements for charges you do not recognize.
- If you already gave a code or card number, call your bank and ezTravel support using numbers from the official site, not from the message.
- See how scammers use leaked data when a caller already knows your booking.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give booking sites their own addresses. Frame never collects or stores the leaked records themselves.
Related coverage
- Singapore Airlines says about 46,000 bookings were reached in the Amadeus breach: another recent travel-booking disclosure.
- How scammers use leaked data to make phishing personal.
Sources
- Taipei Times, ezTravel reports data breach affecting over 690,000 users, November 9, 2026
More stories
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.