Taiwanese online travel agency ezTravel (易遊網) says an unidentified attacker got into its member center and took contact details from past bookings belonging to more than 690,000 customers. The company detected the intrusion on Saturday, 7 November 2026, and published a statement on Monday, 9 November. CNA, which supplied the reports in Focus Taiwan and the Taipei Times, and Mirror Media, syndicated on Yahoo Taiwan, all give the same figure: more than 690,000 people after duplicates were removed. ezTravel says no credit card numbers, security codes, passwords, passport numbers or national ID numbers were taken. It has warned customers that the stolen order details are likely to be used in scams where criminals pose as customer service or bank staff. No attacker has claimed the breach, and ezTravel has not said how the attacker got in.
What Happened
ezTravel's statement says it detected "abnormal external" network activity aimed at its member center on 7 November. Focus Taiwan describes the target as the company's "membership system." The company says it switched on its incident response process straight away and blocked the malicious traffic. It has also hired an outside cybersecurity firm to investigate and carry out digital forensics.
The company says it reported the incident to the relevant government authorities and to the police within the deadline set by Taiwan's personal data protection law. Mirror Media reports that ezTravel filed a formal police report as well as notifying regulators. No regulator has published anything about the incident yet.
ezTravel has sent text messages and emails to affected customers. Mirror Media reports that the company deliberately left links out of these messages so that scammers cannot easily copy them, and that it told customers to treat any "ezTravel" notice that does contain a link as suspicious. The company apologised publicly and said it "would not shirk its responsibilities."
Every account so far comes from ezTravel's own statement as relayed by the press. No outside researcher, attacker or regulator has given a separate account.
What Was Taken
Based on its early investigation, ezTravel says the exposed data comes from past order records and may include:
- Customer names
- Email addresses
- Phone numbers
- Order and product details from previous bookings
Number affected: more than 690,000 customers after deduplication. CNA, the Taipei Times and Mirror Media all report this figure, and none gives a different one. The company has not said how many order records sit behind that number, how far back the records go, or whether non-member bookers are included.
What the company says was not taken: credit card numbers, card security codes (CVV), account login passwords, passport numbers and national ID numbers. ezTravel concludes that payment security is not affected. That conclusion comes from an early investigation that is still running, and the forensic work could change the scope.
The data has limited value on its own, but it is very useful for fraud. Knowing that a named person bought a particular trip from ezTravel, and having their phone number and email, is the raw material for convincing scam calls.
Why It Matters
This data feeds fraud directly. ezTravel warns that scam rings may pose as its customer service team or as bank staff. They may use excuses such as "abnormal orders," "order setup errors," "duplicate charges" or "handling fee problems" to talk victims into handing over verification codes or using an ATM or online banking to "cancel an installment plan." That ATM and installment script is a well-known fraud pattern in Taiwan. Real order details make the calls much harder to spot as fake.
ezTravel is a large platform. A Japanese consumer review site describes it as one of Taiwan's largest online travel agencies. The site says ezTravel holds a Class A travel agency licence from Taiwan's Tourism Administration and runs service counters in major rail stations. At that size, the exposed group is a meaningful share of Taiwan's travelling public.
It is part of a run of attacks on travel companies in the region. There is no evidence linking these incidents to ezTravel, but defenders should note how many there have been:
- Seoul PASS (Travolution Inc.) disclosed unauthorised access to its reservation management system on 6 and 8 November, one day before and one day after ezTravel's detection. Names, emails, phone numbers, nationality and booking details were exposed, and no payment data.
- Rakuten Travel disclosed two separate incidents on 26 October. KEYRING's analysis of the disclosure puts the totals at up to roughly 2.6 million logged-in users on an overseas hotel site and up to roughly 860,000 on a multilingual booking site. Partial card data was exposed for up to about 36,000 bookers.
- Skyticket said in October that up to 14.64 million customer records may have been accessed, about 4.13 million of them including login passwords, according to The Japan Times. H.I.S. and Temairazu reported incidents in the same period.
- TEZ TOUR confirmed a cyberattack in September. RAEM.KZ reports that the company disputes a group called DataSuckers, which claims to have stolen and destroyed about 395.5 million records.
The incidents share a pattern. Attackers are going after booking and member systems that hold contact details and travel plans, and the companies keep stressing that card data was not exposed. For customers, the main harm is not stolen card numbers but targeted social engineering.
The Attack Technique
Unknown. ezTravel has said only that it saw abnormal external network traffic aimed at its member center and blocked it. It has not said whether the attacker:
- exploited a vulnerability in the web application,
- abused weak access controls on order-lookup functions (for example, enumerating order or member IDs),
- used stolen staff or customer credentials, or
- got in through a third-party supplier.
The wording, an "external attack" on a customer-facing member portal that exposed past order contact records, fits data being pulled out through the application layer rather than a full network compromise. That reading is inference, not something the company has confirmed. No group has claimed responsibility, no data sample has appeared publicly, and no indicators of compromise have been released. The outside forensic team's findings may add detail. Until then, any attribution would be speculation.
What Organizations Should Do
- Rate-limit and monitor customer portals for bulk data access. Member centers and order-history pages are where scraping and enumeration happen. Alert on sessions or IPs that pull unusually large numbers of order records, sequential ID requests, and API calls that return other customers' data.
- Cut down what the portal can return. Old order contact data should not stay fully exposed through customer-facing systems indefinitely. Archive or mask old records (for example, partial phone numbers and emails in order views) so that a portal-level compromise yields less.
- Test object-level authorisation on every order and member endpoint. Insecure direct object references and broken access control on booking lookups are a common way into travel platforms. Make them a priority in penetration tests and code review.
- Prepare anti-fraud messaging before you need it. ezTravel's link-free notifications and its explicit "we will never ask for verification codes or ATM operations" list are a good model. Agree templates in advance so notification goes out within hours, not days.
- For banks and payment providers serving Taiwanese customers: expect a rise in "installment cancellation" and "duplicate charge" scam calls that refer to real ezTravel bookings. Brief call-center staff and consider extra fraud scoring for customers who say they have been contacted about a travel booking.
- For security teams in the travel sector: given the cluster of incidents at Seoul PASS, Rakuten Travel, Skyticket and others, check reservation management and member systems for unusual access over the past 90 days, and confirm logging is good enough to measure what was accessed if you are hit.
Sources: ezTravel reports data breach affecting over 690,000 users - Taipei... | 易遊網69萬會員歷史訂單外流爆資安危機！官方急發通知 防詐攻略一次看 | Data leaks at travel companies could impact millions of customer re... | 台湾最大手「易遊網」の評判は怪しい？安全性と予約手順を徹底検証【2026】 | Important Notice of Personal Data Breach and Our Apology - Seoul PASS | TEZ TOUR Cyberattack: Examining DataSuckers’ Leak Claims RAEM | 楽天トラベルへの不正アクセスで最大約260万件などが対象に。何が分かり、何が分かっていないのか｜情報漏えい原因調査レポート｜KEYRING | ezTravel says credit card numbers safe after data breach - Focus Ta...