ENKR

Rakuten Travel overseas hotel and multilingual booking sites breach

Add to my breach check

Made public

What leaked8

Replaceable

  • Card expiry date

Hard to replace

  • Mobile number
  • Partial card number
  • Email address
  • Other profile data
  • Username

Permanent

  • Purchase or order history
  • Full name
  • Card expiry datesame up to about 36,000 bookings
  • Mobile numberphone number · type not stated; bookers and logged-in customers of the overseas hotel pages
  • Purchase or order historybooking details such as property name and price
  • Partial card numberissuer identification number and last 4 digits, cardholder name and card brand, up to about 36,000 bookings; no full card numbers or security codes
  • Email addressall four groups, including hotel staff
  • Full namebookers and their companions, and customers who logged in to the overseas hotel pages; not for the multilingual site
  • Other profile datacountry of residence of bookers and companions; Rakuten's internal ID number
  • Usernameaccount names of up to about 40,000 hotel staff who used the multilingual site's admin screen

To-dos2 · about 10 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls

What happened next10 events

  1. UndetectedNone on record
  2. Response 10 eventsNotice in 46 days · show events
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record
  1. No secondary harm and no effect on other services found so far; the leaked items alone cannot be used for payments or cash advances
  2. Opened dedicated contact points for each of the two sites and for hotel staff
  3. Said it would contact affected users and bookers one by one, with a warning
  4. By 26 October, reported to Japan's Personal Information Protection Commission and the relevant authorities abroad
  5. Apologised in its notice
5 more
  1. Notice: data of up to about 40,000 bookings (about 36,000 with partial card data) and 2.6 million logged-in customers of the overseas hotel pages, and of up to about 860,000 logged-in customers and 40,000 hotel staff of the multilingual site, was the target of the access
  2. Finished fixing the multilingual booking site's system
  3. Detected possible unauthorised access to the Rakuten Travel multilingual booking site and found the cause the same day
  4. Found the cause on 15 September and finished fixing the system on 16 September
  5. Detected anomalies on some overseas hotel booking pages run by its subsidiary Rakuten Travel Xchange
Company
Rakuten Travel
Company detected it
Made public
Notice
Leak confirmed
Affected
about 2.6 million logged-in customers of the overseas hotel pages, at most · the largest of four groups that may overlap; also up to about 40,000 bookings, about 36,000 with partial card data, and on the multilingual booking site about 860,000 logged-in customers and 40,000 hotel-staff accounts; company notice

Sources