Rakuten Travel Overseas Hotel Booking Pages Compromised, Large Volume of Customer Data Potentially Exposed

According to Security NEXT, Rakuten Travel Xchange detected anomalies on certain overseas hotel booking pages on September 10, 2026, and an investigation confirmed a compromise ^[1]. The accessed scope includes booking customer data for up to approximately 40,000 records—of which up to roughly 36,000 included the last four digits of payment cards, cardholder names, and expiration dates—as well as contact details for up to approximately 2.6 million logged-in users ^[1]. The company completed remediation on that system on September 16, but discovered another suspected intrusion on Rakuten Travel's multilingual booking website on October 20 ^[1].

Industries mainly affected: Hospitality & food service

The company completed remediation on that system on September 16, but discovered another suspected intrusion on Rakuten Travel's multilingual booking website on October 20 ^[1].