Japan's Rakuten Travel explodes with large-scale personal information leakage, industry operators respond

Recently, it was reported that the overseas hotel reservation website of "Rakuten Travel (楽天トラベル)", a travel reservation platform owned by Japan's Rakuten Group, has been accessed without authorization, and 2.6 million pieces of personal information may have been leaked. There may also be 8 multi-lingual websites targeting foreign users. 60,000 pieces of personal information were leaked; in response, Rakuten responded that it is currently contacting affected users and booking users individually and taking measures to prevent secondary damage. There has not yet been any secondary damage or impact on other services.

According to TBS, Japan's Rakuten revealed that an abnormality occurred in the overseas hotel reservation interface on September 10, which may have resulted in the leakage of the logged-in user's name, email account, and phone number. A total of 2.6 million transactions were made, of which 36,000 involved the last 4 digits of the payment user's credit card number, expiration date and other information. On October 20, a multi-lingual reservation website for foreign users was also suspected of unauthorized access. It is possible that the email accounts of 860,000 users were leaked. They did not include information such as credit card numbers or passwords. No information has been found to have been improperly used.

Lotte Travel responded that Lotte Group has a dedicated team of information security experts responsible for assessing and monitoring potential risks in our services. It also follows relevant procedures to report to affected governments and competent authorities, and discloses information to users in a timely and transparent manner when necessary.

Rakuten Travel stated, "We would like to express our deepest apologies if this incident has caused inconvenience and concern to customers." The company is contacting affected users and booking users individually and taking measures to prevent secondary damage. There has been no secondary damage or impact on other services caused by this incident. "We take this matter seriously and continue to work to strengthen information security measures to prevent any damage."