《TAIPEI TIMES》ezTravel reports data breach affecting over 690,000 users
Quick Look
- Taiwanese online travel agency Yiyou.com discovered on Saturday that its membership center had been attacked by an unusual external network, resulting in unauthorized access to the historical order contact information of more than 690,000 customers.
- Preliminary investigation showed that no credit card numbers were involved.
- The company has activated the security protection mechanism, entrusted a third-party network security team to investigate, and reported the case to the competent authorities and the police.
AI-generated summary
Why It Matters
Yiyou.com, an online travel agency in Taiwan, suffered an unusual external network attack on its membership center on Saturday, resulting in unauthorized access to customer contact information in historical orders. The company has activated a network security defense and response mechanism and entrusted a third-party team to conduct digital forensic investigation.
Online travel agency ezTravel on Saturday detected an abnormal external cyberattack on its member center, resulting in the unauthorized access of contact information from historical orders of more than 690,000 customers.
While a preliminary investigation showed that the breach did not involve credit card numbers, the company urged customers to remain vigilant against scams.
In a statement yesterday, ezTravel said that it immediately activated its cybersecurity defense and response mechanisms after detecting the attack, and successfully blocked the abnormal traffic.
It has also commissioned a third-party cybersecurity team to assist with the investigation and conduct digital forensics, the company said.
The compromised data potentially include names, e-mail addresses, phone numbers and product order information from historical records, ezTravel said.
After cross-referencing and removing duplicates, the number of affected customers exceeded 690,000, it said.
The agency has reported the incident to the competent authorities and police within the legal timeframe in accordance with personal data protection laws, it added.
The incident did not compromise credit card numbers, security codes or account passwords, nor did it leak customers' passport or ID card numbers, meaning the security of all financial transactions remains unaffected, ezTravel said.
The company apologized for the anxiety and concern caused to consumers, adding that it does not take threats to customer data security lightly and would not shirk its responsibilities.
Consumers have been notified via text messages and e-mails to warn of potential risks, ezTravel said.
Scam rings might use the stolen order information to impersonate customer service representatives or bank staff, it said.
Scammers often use excuses such as "abnormal orders" or "duplicate charges" to trick consumers into providing credit card information and SMS verification codes, or instruct them to operate ATMs and click on malicious links, it added.
The travel agency reminded its customers that it would never ask for account passwords or verification codes, or instruct them to operate an ATM to cancel installment payments via phone call, text message or e-mail.
What to Watch
AI outlook — possibilities, not facts
Fraudulent groups may use leaked order information to impersonate customer service or bank personnel to commit fraud.
Likely · Within days
Open Questions
- The specific identity and origin of the attacker
- Will data leakage lead to subsequent fraud cases?
- What specific remedial measures will the company take to compensate affected customers?
