Travolution Inc., the South Korean company that runs the Orderect booking site and the Seoul PASS travel pass service, says an unauthorised third party got into its reservation management system twice, on November 6 and November 8, 2026. The attacker viewed reservation records and took some customer information. The company published the same apology notice on both Orderect and Seoul PASS on November 9. The exposed records mostly cover bookings with dates of use from 2022 to 2026. Travolution has not said how many customers or bookings are affected. Japanese security outlet Security Measures Lab also notes that the notice gives no total count.
What Happened
According to Travolution's notice, someone without authorisation "abnormally accessed" the reservation management system on November 6 and again on November 8. The company says it spotted each intrusion on the day it happened and blocked the access. It has not explained how an attacker who was blocked on the 6th got back in two days later.
Security Measures Lab's summary of Travolution's response says the company has:
- blocked the route the attacker used and disabled the accounts involved
- revoked access permissions it had already issued
- replaced servers and its main security keys
- tightened login and access restrictions and increased monitoring
The same outlet says Travolution reported the incident to authorities as Korean law requires. No regulator filing has been made public. The company has not said whether one attacker carried out both intrusions, how they first got in, or whether a software flaw was involved. Security Measures Lab warns against reading the key replacement as proof that stolen keys caused the breach, and that caution applies here too.
Travolution is emailing affected customers at the address they booked with. It has also launched a "Check My Information" page where customers can look up their booking email.
What Was Taken
Travolution says the exposed data differs from customer to customer. The categories it lists are:
- the booker's name
- booking details: order number, product, date of use and number of people
- nationality
- email address and phone number, for some bookings only
- any extra information a customer entered when booking, for some customers
The two versions of the notice differ in one detail. The Seoul PASS notice and Security Measures Lab both say ticket codes were exposed for some customers. The Orderect notice does not mention ticket codes. It is not yet clear whether Orderect customers lost ticket codes or whether the codes only affected Seoul PASS bookings.
Travolution says most bookings exposed only a name and booking details. It also says payment card details, bank account details and passwords were not exposed.
No one has published a figure for how many records were affected, and the company has not given one.
Why It Matters
Travel booking data is very useful to scammers. A record showing a person's name, nationality, product, travel date and group size lets a fraudster send a "booking confirmation", "schedule change" or "ticket reissue" message that matches a trip the victim really booked. Travolution's own notice puts its impersonation warning first. It says it never asks for card details or passwords by email, text, phone or messenger. It says it only requests booking information from @orderect.com and @bankoftrip.com addresses, with @seoultravelpass.com and @seoulpass.kr also listed for Seoul PASS. Security Measures Lab notes that no follow-on fraud linked to this breach has been confirmed so far.
This breach is one of several in Asian online travel this autumn. On the same weekend, Taiwanese travel agency ezTravel disclosed an attack on its member centre that exposed contact details and order history for more than 690,000 customers, the Taipei Times reports. In October, Japanese booking site skyticket disclosed three separate intrusions, the largest exposing about 14.64 million customer records, according to The Tokyo Nomad. That report also says Japan's NICT has warned of attacks that start by analysing a company's app and then go after server endpoints that do not properly check who may read what. Separately, TRUV.IS tracks a long-running campaign that uses fake guest and Booking.com messages to trick hotel staff, take over property accounts and defraud guests. That shows how quickly criminals turn booking context into convincing lures. No source links the Travolution intrusions to any of these incidents.
The Attack Technique
The intrusion method has not been disclosed. Travolution describes the activity only as unauthorised access that let the attacker view reservation records. Its response suggests account or credential abuse may have been involved: disabling specific accounts, revoking issued permissions and rotating keys. The company has not confirmed this, though. A second successful entry two days after the first was blocked suggests the first fix did not close every way in, or that the attacker had more than one.
Recent breaches at similar booking platforms show a few common entry points. These are possibilities to check for, not confirmed causes here. They include back-office and admin interfaces reachable from the internet, booking or ticket endpoints that hand out records without checking that the requester owns them, and API keys or secrets left exposed in application code or configuration.
What Organizations Should Do
- Assume follow-up phishing. Warn staff and customers who used Orderect or Seoul PASS that messages quoting real booking details may be fraudulent. Tell them to verify any payment or reissue request through the official site rather than links in messages.
- Check reservation back-office access. Audit who and what can query booking records in bulk, including service accounts and API tokens. Remove standing access that is not needed and require MFA on every admin login.
- Treat containment as unconfirmed until proven. When you block an intrusion, rotate every credential, key and session that system could reach. Then watch closely for the attacker coming back. Travolution's second intrusion shows why.
- Enforce authorisation on the server. Make sure booking, ticket and order endpoints check that the requester is allowed to see that specific record. Do not rely on the app or front end to limit what gets asked for.
- Alert on unusual read volume. Bulk viewing or exporting of reservation records should trigger alerts the same day, especially from admin accounts or at unusual hours.
- Hold less old data. Bookings going back to 2022 were exposed. Purge or archive past-trip contact details you no longer need so a single breach reaches fewer people.
Sources: Important Notice of Personal Data Breach and Our Apology - Official... | 韓国「Seoul PASS（ソウルパス）」に不正アクセス、2022～2026年の旅行予約情報が流出 11月6日・8日に2度侵害セキュリ... | Important Notice of Personal Data Breach and Our Apology - Seoul PASS | ezTravel reports data breach affecting over 690,000 users - Taipei... | Skyticket breach: three ways in, 14.64 million records | Takeoff (Active Box) HackwithDeesick | HTB Titanic | Booking.com hotel ClickFix - fake guest and Booking.com messages le...