ENKR

Adventure skyticket customer data breach

Add to my breach check

Made public

What leaked12

Replaceable

  • Card number
  • Plain-text password
  • Password
  • Card expiry date

Hard to replace

  • Bank account number
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Date of birth
  • Purchase or order history
  • Full name
  • Card numbercard number, holder name and expiry of up to 6,140 people who paid skyticket Premium fees from February 2017 to June 2018; encrypted, but the key was also taken
  • Plain-text passwordBenefit Station member IDs, names and passwords of skyticket Premium members; encrypted, but the key was also taken
  • Passwordhashed login passwords, about 4.13 million members
  • Bank account numberrefund account details (bank, branch, type, number, holder) in the business-system intrusion, 17,780 records
  • Card expiry datesame skyticket Premium card holders · some had the number only
  • Mobile numberphone number · type not stated
  • Home or delivery addresspostcode and address
  • Purchase or order historybus bookings viewable without login: route, date, operator, booking number, payment method and amount; companions' names, ages and genders · about 12,000 bookings
  • Full nameincluding passport spelling
  • Other profile dataname of the remitter on bank transfers

To-dos7 · about 2 h in all

  1. Have the card reissued with a new numberabout 15 minStops: card fraud online
  2. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  3. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  4. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls, card fraud online
  5. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover, SMS code theft
  6. Do nowTurn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover
  7. This weekRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next12 events

  1. Undetected 3 events56 days · show events
  2. Response 9 eventsNotice in 10 days · show events
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record
  1. Second report: card data of up to 6,140 skyticket Premium payers was also taken from logs left on a server, correcting the first report
  2. Phone line for the breach opened · weekdays 10:00 to 18:00
  3. Timely disclosure filed on TDnet
  4. Notice of three separate intrusions, the server intrusion alone affecting about 14.64 million records
  5. Emails about the leak, asking customers to change their passwords, sent from [email protected] from about 19:00
7 more
  1. Payment with saved cards and card saving stopped at about 18:00
  2. Server intrusion of 2 to 4 October found
  3. Bus booking-complete pages viewable without login found and fixed the same day
  4. Intrusion into the skyticket business-management system (on 20 September) found
  5. Adventure: an unauthorised login to one member's account on 9 September 2026; no other secondary harm from the leaked data confirmed so far
  6. Intrusion began
  7. Reported to the Personal Information Protection Commission
Company
Adventure Inc.
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
14,640,000 records of people who registered or entered details on skyticket · server intrusion; about 4.13M include hashed passwords; plus 17,780 records via the business system, about 12,000 bus bookings and up to 6,140 skyticket Premium card holders

How the facts developed

  1. Second report corrected the first: old payment logs left on a server exposed card numbers, holder names and expiry dates of up to 6,140 skyticket Premium payers, plus Benefit Station IDs and passwords
  2. Full notice a day after the first emails: three separate intrusions; about 14.64 million records from the server intrusion; Adventure said no card numbers were stored or leaked

Sources