Breach · 3 min read
Orderect: reservation details leaked after unauthorized access on November 6 and 8
Travolution, which runs Orderect, says an intruder viewed booking records on two days. Names and booking details were reached; emails and phones for some. Cards and passwords were not included.
Travolution Inc., the operator of the Orderect booking site, said on November 9, 2026 that an unauthorized party accessed its reservation management system on November 6 and again on November 8, and that some customer information leaked as a result. The company published an English notice the same day.
What happened
On both dates, Travolution says, an unauthorized third party abnormally accessed the reservation system and viewed booking information. The company says it identified each incident the same day and blocked the access. It has blocked the intrusion route and related accounts, replaced servers and major security keys, invalidated issued access rights, tightened login controls, and reported the incident to the relevant authorities.
What was involved
Affected bookings are mainly those with dates of use from 2022 to 2026. Depending on the customer, the leaked fields can include:
- booker’s name
- email address
- phone number
- nationality
- booking details (order number, product, date of use, number of people)
- for some customers, extra information entered at booking
Most bookings, the company says, involved only the booker’s name and booking details. Email addresses and phone numbers were included for only some bookings. Payment card and bank account information and passwords were not included.
How to check
Travolution says it is sending individual notices to the email used for booking when a leak is confirmed. You can also use its Check My Information page: enter the booking email and a verification code sent to that address.
What this means for you
A name plus a past tour date is enough for a fake “change your booking” or “confirm payment” message. The company warns that emails, texts or calls impersonating Orderect may follow, and says it never asks for card details or passwords by email, text, phone or messenger. Extra booking questions, it says, come only from @orderect.com or @bankoftrip.com addresses.
What you can do
- Use the official Check My Information page if you booked through Orderect between 2022 and 2026.
- Change bookings only on the Orderect website or through official support (cs@orderect.com), not through a link in an unexpected message.
- Ignore requests for card details, passwords or payment links that claim to be about this incident.
- In Korea, you can also contact the Personal Information Dispute Mediation Committee (www.kopico.go.kr / +82-1833-6972) or KISA’s Personal Information Infringement Report Center (privacy.kisa.or.kr / +82-2-118).
- See personalized phishing after a leak if a message already cites your trip.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.
Related coverage
- ezTravel: contact details from past orders of more than 690,000 customers were reached: another November travel-booking disclosure in the region.
- How scammers use leaked data to make phishing personal.
Sources
- Travolution Inc. (Orderect), Notice of Personal Data Breach and Our Apology, November 9, 2026
More stories
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.