Confirmed

Adventure (skyticket): multi-path intrusion leaked customer personal data

Customer notice emails and authenticity page on Oct 8, 2026; detailed notice Oct 9. Paths: (1) server intrusion Oct 2–4 leaking ~14.64M registrants (incl. ~4.13M hashed passwords); (2) ops-system intrusion Sep 20 affecting 17,780 records (duplicates; more under review) with name/phone/refund bank details; (3) bus booking completion pages viewable without login Aug 3–Oct 1 (~12,000 bookings scraped). No card numbers or passport images held. First disclosure Oct 8.

Last updated: 2026-11-09

Overview

Headline counts use “about”; 17,780 is a duplicate-including subset still under review → blank total.

Timeline

UnknownOccurred
2026-10-05Discovered
2026-10-08Disclosed

Organization response

Per the notice, the organisation investigated and contained the incident, notified individuals and offered monitoring or protective resources.

What you can do

Be wary of emails, SMS or calls impersonating the organisation; do not open links or attachments or enter passwords or card details. Change reused passwords on other services.

Sources

【重要】当社よりお送りした「個人情報の流出に関するお知らせ」メールについて株式会社アドベンチャー · 2026-11-09
不正アクセスによるお客様情報の流出に関するお詫びとお知らせ（適時開示）株式会社アドベンチャー · 2026-11-09
不正アクセスによるお客様情報の流出に関するお詫びとお知らせ株式会社アドベンチャー · 2026-11-09

Adventure (skyticket): multi-path intrusion leaked customer personal data

Overview

Timeline

Organization response

What you can do

Sources

Related information

No published information yet

Comments and replies

Write a comment