Japanese Travel Platform *Adventure* Suffers Massive Data Breach Affecting 14.64 Million Customers
On October 9, 2026, Adventure, a Japanese online travel-booking company, disclosed a major data breach impacting its skyticket platform. The incident exposed or potentially compromised 14.64 million customer records, including names, dates of birth, contact details, and 4.13 million hashed login passwords. The company confirmed that no passport numbers were leaked but took immediate action by reporting the breach to Japan’s Personal Information Protection Commission, blocking unauthorized access routes, and suspending payments via stored credit cards as a precautionary measure.
The breach highlights growing cybersecurity risks in the travel industry, where large-scale customer data repositories remain prime targets for attackers. Adventure has not yet provided details on the attack vector or whether the incident involved ransomware or other malicious activity. The full statement was released in Japanese.
Adventure TPRM report: https://www.rankiteo.com/company/g-adventures
"id": "g-a1791542071",
"linkid": "g-adventures",
"type": "Breach",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '14.64 million',
'industry': 'Travel',
'location': 'Japan',
'name': 'Adventure (skyticket platform)',
'type': 'Online Travel Booking Company'}],
'customer_advisories': 'Public disclosure of breach details',
'data_breach': {'data_encryption': 'Hashed passwords (4.13 million)',
'number_of_records_exposed': '14.64 million',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Dates of birth',
'Contact details',
'Hashed login passwords']},
'date_publicly_disclosed': '2026-10-09',
'description': 'On October 9, 2026, *Adventure*, a Japanese online '
'travel-booking company, disclosed a major data breach '
'impacting its *skyticket* platform. The incident exposed or '
'potentially compromised 14.64 million customer records, '
'including names, dates of birth, contact details, and 4.13 '
'million hashed login passwords. The company confirmed that no '
'passport numbers were leaked but took immediate action by '
'reporting the breach to Japan’s Personal Information '
'Protection Commission, blocking unauthorized access routes, '
'and suspending payments via stored credit cards as a '
'precautionary measure.',
'impact': {'data_compromised': '14.64 million customer records, including '
'names, dates of birth, contact details, and '
'4.13 million hashed login passwords',
'identity_theft_risk': 'High',
'operational_impact': 'Suspension of payments via stored credit '
'cards',
'payment_information_risk': 'High',
'systems_affected': 'skyticket platform'},
'investigation_status': 'Ongoing',
'references': [{'source': 'Company Statement'}],
'regulatory_compliance': {'regulatory_notifications': 'Reported to Japan’s '
'Personal Information '
'Protection Commission'},
'response': {'communication_strategy': 'Public disclosure, statement released '
'in Japanese',
'containment_measures': 'Blocking unauthorized access routes, '
'suspending payments via stored credit '
'cards'},
'title': 'Japanese Travel Platform *Adventure* Suffers Massive Data Breach '
'Affecting 14.64 Million Customers',
'type': 'Data Breach'}