ENKR

Adventure skyticket customer data breach

Add to my breach check

Made public

What leaked12

Replaceable

  • Card number
  • Plain-text password
  • Password
  • Card expiry date

Hard to replace

  • Bank account number
  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data

Permanent

  • Date of birth
  • Purchase or order history
  • Full name
  • Card numbercard number, holder name and expiry of up to 6,140 people who paid skyticket Premium fees from February 2017 to June 2018; encrypted, but the key was also taken
  • Plain-text passwordBenefit Station member IDs, names and passwords of skyticket Premium members; encrypted, but the key was also taken
  • Passwordhashed login passwords, about 4.13 million members
  • Bank account numberrefund account details (bank, branch, type, number, holder) in the business-system intrusion, 17,780 records
  • Card expiry datesame skyticket Premium card holders · some had the number only
  • Mobile numberphone number · type not stated
  • Home or delivery addresspostcode and address
  • Purchase or order historybus bookings viewable without login: route, date, operator, booking number, payment method and amount; companions' names, ages and genders · about 12,000 bookings
  • Full nameincluding passport spelling
  • Other profile dataname of the remitter on bank transfers

To-dos7 · about 2 h in all

  1. Have the card reissued with a new numberabout 15 minStops: card fraud online
  2. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  3. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  4. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls, card fraud online
  5. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover, SMS code theft
  6. Do nowTurn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover
  7. This weekRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next12 events

  1. Undetected 3 events56 days · Back to latest
  2. Response 9 eventsNotice in 10 days · show events
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record

Undetected: 3 events

Back to latest
  1. Intrusion into the skyticket business-management system (on 20 September) found
  2. Adventure: an unauthorised login to one member's account on 9 September 2026; no other secondary harm from the leaked data confirmed so far
  3. Intrusion began
Company
Adventure Inc.
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
14,640,000 records of people who registered or entered details on skyticket · server intrusion; about 4.13M include hashed passwords; plus 17,780 records via the business system, about 12,000 bus bookings and up to 6,140 skyticket Premium card holders

How the facts developed

  1. Second report corrected the first: old payment logs left on a server exposed card numbers, holder names and expiry dates of up to 6,140 skyticket Premium payers, plus Benefit Station IDs and passwords
  2. Full notice a day after the first emails: three separate intrusions; about 14.64 million records from the server intrusion; Adventure said no card numbers were stored or leaked

Sources