Adventure (skyticket): multi-path intrusion leaked customer personal data

Customer notice emails and authenticity page on Oct 8, 2026; detailed notice Oct 9. Paths: (1) server intrusion Oct 2–4 leaking ~14.64M registrants (incl. ~4.13M hashed passwords); (2) ops-system intrusion Sep 20 affecting 17,780 records (duplicates; more under review) with name/phone/refund bank details; (3) bus booking completion pages viewable without login Aug 3–Oct 1 (~12,000 bookings scraped). No card numbers or passport images held. First disclosure Oct 8.