Japanese travel booking platform Skyticket has disclosed a major data breach that may have exposed the personal information of approximately 14.64 million customers. Its operator, Adventure Inc., said attackers gained unauthorized access to internal servers and cloud storage between October 2 and October 4, 2026. The company publicly confirmed the incident on October 9 after blocking the access route and launching an investigation. The breach is among the largest recent cybersecurity incidents involving a Japanese travel company.
The compromised records reportedly include customers’ names, dates of birth, email addresses, phone numbers, postal codes, addresses, and names used for bank transfers. Adventure also said about 4.13 million records contained hashed login passwords. The company stated that passport numbers and credit card information were not leaked, although it temporarily disabled payments using saved credit cards as a precaution.
Adventure identified additional unauthorized-access incidents beyond the main breach. It said attackers accessed its business management system on September 20, potentially compromising more than 17,000 customer records, including bank account details registered for refunds. A third incident involved bus booking confirmation pages that could be accessed without logging in; the company said it detected and fixed the issue on October 1.
The company has reported the incidents to Japan’s Personal Information Protection Commission and said it is continuing to investigate. Adventure warned customers that they could receive fraudulent emails, text messages, phone calls, or letters pretending to be from Skyticket, banks, airlines, or bus companies. It urged users not to click links in suspicious messages or share passwords, credit card numbers, bank PINs, or online banking credentials.
Skyticket members should change their passwords immediately through the official website or app and update the same password anywhere else it has been reused. Security experts generally recommend enabling multi-factor authentication where available and monitoring bank statements for unusual activity. The incident highlights the growing risk facing travel platforms, which hold large volumes of identity, contact, payment, and booking data attractive to cybercriminals.