Overview
Event 1: up to ~40,000 bookers (up to ~36,000 with partial payment data, no full card numbers) and up to ~2.6 million logged-in users. Event 2: up to ~860,000 logged-in users and up to ~40,000 property staff. Overlap unknown; not summed (count blank). The company describes the data as "targeted" without stating confirmed acquisition.
Timeline
- Occurred
- Discovered
- Disclosed
Organization response
Per the notice, the organisation investigated and contained the incident, notified individuals and offered monitoring or protective resources.
What you can do
Be wary of emails, SMS or calls impersonating the organisation; do not open links or attachments or enter passwords or card details. Change reused passwords on other services.
Sources
- 海外ホテル予約サイトの一部ページならびに多言語予約サイトに関するお詫びとお知らせ楽天グループ株式会社 · 2026-11-09