Kobo Co., Ltd.: API Server Breach Exposes Highway Bus Passenger Bookings

Kobo Co., Ltd. runs the Japanese highway bus booking portal Hassha Orai Net and its English-language counterpart, Japan Bus Online. The company has confirmed that unknown attackers broke into an API server it uses to connect its reservation system with bus operators and travel sites, and took customer booking data. The intrusion ran from September 16 to September 19, 2026. Kobo did not detect it until October 13. The company says up to 8,341 reservations covering 5,614 people may be affected and that both figures are still being finalised. Exposed fields include passenger names written in katakana (the Japanese phonetic script), phone numbers, and trip details. Kobo first disclosed the breach in Japanese on October 15. Its English notice for Japan Bus Online users did not appear until November 9, and in it the company apologised for the delay.

What Happened

Kobo's notices give this timeline:

• September 16 to 19, 2026: Suspicious access to the partner integration API server. Kobo uses this server to supply reservation services to bus operators and other companies, including Hassha Orai Net and Japan Bus Online.
• October 13: Kobo detects the access, about three and a half weeks after it ended. It cuts the server off from the network right away, but finds signs that reservation data had already been taken.
• October 15: Kobo posts its Japanese disclosure on Hassha Orai Net. Chugoku Bus publishes its own notice that evening.
• October 16 onward: Bus operators across Japan post their own notices. These include Keisei Bus Group (for its Keisei Bus Chiba Central and Keisei Bus Chiba East subsidiaries), Wakayama Bus, JR Shikoku Bus and Foot Bus. Security Lab, a Japanese security news site, counted affected operators from Hokkaido to Kyushu by October 18. Its list includes Hokkaido Chuo Bus, Kanto Bus, Tobu Bus, Meitetsu Bus, West JR Bus, Iruka Kotsu and Hiroden Mobility Service.
• November 9: Kobo publishes an English-language apology for Japan Bus Online users.

Kobo says it has reported the incident to Japan's Personal Information Protection Commission, which regulates data protection. It has also filed a damage report with the local police and says it is cooperating with the criminal investigation. It has notified the bus companies and travel sites connected to the platform, finished security work on the affected server, and confirmed that the unauthorized access has not continued. Notices from Wakayama Bus and Chugoku Bus add that Kobo is working with outside specialists to find the cause and the full scope.

No group has claimed the attack, and nobody has named who was behind it.

What Was Taken

According to Kobo, the stolen data covers some reservations for travel dates between July 16 and November 29, 2026. It includes:

• Reservation name (the passenger's name in katakana)
• Telephone number
• Booking details: travel date, route and reservation number

Kobo says the server did not hold credit card data, bank account details, home addresses, email addresses or passwords.

Volume. Kobo's upper limit is 8,341 reservations and 5,614 people across all connected partners. Of those, 548 reservations and 448 people were booked through the Hassha Orai Net site itself. Kobo's English notice does not give a separate figure for Japan Bus Online.

Bus operators have published their own partial counts:

These counts appear to be subsets of Kobo's total. Routes run jointly by several companies can share the same booking, so the operator figures cannot be added up. The wording also differs. Kobo says data was leaked. Wakayama Bus and Chugoku Bus say only that their customers' data may have leaked, and that they are still checking whether each individual booking was taken.

Why It Matters

The data looks minor at first glance, with no payment cards or passwords. The risk is in the combination. The attackers hold a name, a phone number, a route, a reservation number and a travel date, and many of those trips had not yet happened when the data was taken. That is enough to write a convincing scam text, such as "Your 14 November Fukuyama to Matsuyama bus has been cancelled, tap here for a refund", and send it to someone who really did book that bus. Every operator notice warns about SMS phishing and calls from unknown numbers. Kobo says no specific harm has been reported so far.

This is also a supply chain problem. A single integration server at one booking platform exposed customers of dozens of bus companies. Most of those passengers had never heard of Kobo. Several companies had to publish notices about a system they do not run, and Kobo's own notifications took a long time to arrive. The breach was found about 24 days after it ended, and English-speaking users of Japan Bus Online were told almost four weeks after the Japanese announcement. Foreign tourists, who are the most likely to book through Japan Bus Online, were the last to be warned.

The Attack Technique

Kobo has not said how the attackers got into the API server. It has not disclosed a vulnerability, a stolen credential or a misconfiguration. All it has confirmed is the target: an API server used to connect external partners, which Kobo describes as separate from the systems that hold payment and account data. No technical details have been published, and none of the operator notices say anything on the subject.

What can be said is that partner integration APIs tend to be exposed to the internet, use credentials shared with outside parties, and allow bulk queries. Attacks on that kind of interface often involve stolen or weak partner API keys, broken object-level authorisation (where changing an ID in a request returns someone else's record), or endpoints that return far more records than any caller should need. That is general context, not a finding about this incident. Kobo said it had contained and secured the server before it could explain how the attackers got in, so readers should wait for the outside investigation before drawing conclusions.

What Organizations Should Do

1. Treat partner APIs as internet-facing attack surface. List every integration endpoint and give each partner its own scoped credentials. Make sure no single key can pull bookings belonging to other partners or to customers outside that partner's own scope.
2. Alert on bulk reads, not just logins. Here the access lasted four days and was found weeks later. Set baselines for normal query volume and record ranges for each API client, and alert when they are exceeded.
3. Keep less data on integration servers. Kobo kept payment data and passwords off this server, which limited the damage. Go further and remove phone numbers, or mask them, wherever partners do not need them.
4. Put supplier breach-notification terms in contracts. Bus operators learned about this from Kobo, not from their own monitoring. Contracts with booking and distribution platforms should set notification deadlines and require per-operator record counts.
5. Warn customers in every language you sell in, at the same time. Customers who booked through a foreign-language channel should not be told weeks after everyone else.
6. Prepare anti-smishing messages in advance. When booking data is exposed, tell affected customers how to recognise genuine contact from you, and never ask for PINs or card details by SMS. Every operator in this incident gave that advice.

Sources: Apology and Report Regarding the Leakage of Personal Information Du... | 発車オ～ライネット お知らせ一覧 - 発車オーライネット - 発車オ～ライネット | 発車オーライネットの不正アクセスによるサイバー攻撃のまとめ―全国のバス事業者が相次ぎ公表、イルカ交通258件・中国バス17件などセキュ... | Apology for personal information disclosure due to unauthorized acc... | バスチケット予約ポータルサイト「発車オーライネット」における不正アクセスによる個人情報漏えいについて 和歌山バス株式会社 | 発車オーライネットへの不正アクセスによる個人情報流出について 高速バス「フットバス」公式サイト | 「発車オーライネット」への不正アクセスによるお客様情報の漏えいに関するお知らせ 中国バス | 高速バス予約サイト 「発車オーライネット」への不正アクセスによる個人情報流出について - お知らせ