Japanese travel booking site skyticket hit by three separate intrusions, exposing about 14.64 million customer records and some old card data

Japan's Adventure Inc. said on October 9 that its travel comparison and booking site skyticket suffered three unauthorized accesses via different routes, the largest, from October 2 to 4, leaking about 14.64 million customer records including names, birth dates, emails, phone numbers, addresses and about 4.13 million hashed member passwords; it says passport numbers were not leaked ^[1]. A separate intrusion exploiting a business management system flaw leaked 17,780 records including refund bank details, and an October 16 second report corrected the first, saying leftover server logs exposed card numbers and other data of up to 6,140 skyticket Premium members from February 2017 to June 2018 ^[1][2]. skyticket members should change their passwords (including reused ones), check bookings and card statements, and beware of emails, texts and calls impersonating the company or banks ^[1].

Industries mainly affected: Transportation & logistics, Hospitality & food service

1. skyticket members should change their password, and change it on any other service where the same password is used .