Adventure, Inc. (TSE: 6030) runs the Japanese travel comparison and booking site Skyticket. On October 9, 2026, it disclosed that attackers had broken into its systems by three different routes. The largest intrusion ran from October 2 to October 4 and exposed about 14.64 million customer records. About 4.13 million of those include hashed member login passwords. The company's own notice and its investor-relations filing both give these figures, and every outlet reviewed here repeats them with no variation. Two smaller incidents add 17,780 records containing refund bank account details and about 12,000 bus bookings scraped from pages that anyone could open without logging in. Adventure says no credit card numbers or passport images leaked, because it never stored them. It has reported the incidents to Japan's Personal Information Protection Commission (PPC). No threat actor has been named, and no group has publicly claimed the attack.
What Happened
Adventure's notice describes three unrelated incidents, each with its own entry point. Japan Cyber Watch and Cybersecurity Lab (gate02) both reproduce the timeline unchanged:
- Server and cloud intrusion (the main breach): Ran October 2 to 4, 2026, and was detected October 5. Attackers misused some of Skyticket's administrative functions and moved from there to other company servers and to data held in cloud storage.
- Business management system: Breached September 20 through a vulnerability in the system and detected September 28. Separately, the company found one unauthorized login to a single member's account on September 9.
- Bus booking confirmation pages: From August 3 to October 1, booking-completion pages could be viewed without logging in, and a third party viewed them "mechanically" (automated scraping). Adventure found and fixed the flaw on October 1.
Adventure says it cut off the access routes and put vulnerability fixes in place. According to Cybersecurity Lab, it disabled payment with saved credit cards, and the feature that stores card details, at about 18:00 on October 7. It began emailing affected customers and filed with the PPC. Its IR filing says the effect on financial results is still being assessed. The Japan Times summarises the secondary incidents as running "between August and October." That matches the company's dates but blurs the distinct windows above.
What Was Taken
Main breach: about 14.64 million records - Names, including the romanised spelling used on passports - Dates of birth, email addresses, phone numbers, postal codes and addresses - Remitter names used for bank transfer payments - Hashed login passwords for about 4.13 million members
Adventure says it has confirmed that passport numbers were not leaked.
The company counts these as "件" (records or entries), not unique people. Several outlets, including IT Security News and the incident headline itself, describe them as "14.6 million customers." The number of distinct individuals may be lower if one customer appears in several records. Adventure has not published a deduplicated figure.
Business management system: 17,780 records (duplicates included) - Names, phone numbers and refund bank account details: bank name, branch, account type, account number and account holder name - Email addresses and birth dates for 68 records, and postal addresses for 18 - Adventure says it is still counting some categories, so this number may rise. It has not confirmed that passport numbers were safe in this incident and is still checking.
Bus booking pages: about 12,000 bookings - Booker's name (in katakana), age, gender, date of birth (where registered), email, phone and member ID - Device type, payment method and amount, and booking time - Trip details: date, boarding and alighting stops, operator, service name and the operator's booking reference - Names, ages and genders of fellow travellers, so the number of people affected is higher than the booking count
Card data sits with a third-party payment processor, not Adventure. The company says no card data or passport images were exposed in any of the three incidents.
Why It Matters
Scale. At 14.64 million records, this is one of the largest breaches reported by a Japanese travel company. The Japan Times reports it alongside disclosures from H.I.S. and travel technology firm Temairazu in the same week. A commentary on MKUltraman places it in a wider autumn 2026 wave in Japan that includes Times Car (about 6.6 million accounts), Lawson (about 2.16 million records) and JR East's Ekinet. That piece says outright that these were not one coordinated campaign. Nothing in the sources links the Skyticket intrusions to any of the other incidents.
Three separate failures. The three incidents point to weak controls across the company, not one unlucky gap. They involve an exposed admin function, an unpatched business application and a broken access check on a customer-facing page. The bus booking flaw went unnoticed for almost two months.
Phishing material. The stolen data is well suited to fraud: - Verified names, contact details and birth dates make convincing lures. - Live itineraries with operator booking references allow believable "your trip has changed, pay this fee" scams. Adventure warns about exactly this. - Refund account details support fake refund calls designed to obtain bank PINs or online banking credentials.
Adventure itself warns of fake contacts pretending to be Skyticket, banks, airlines and bus operators, by email, SMS, phone and post.
Password reuse. Adventure has not said which hashing algorithm it used or whether hashes were salted. It does warn that the hashes could be cracked and the passwords used against Skyticket and against other services where customers reused them. Treat the 4.13 million hashed passwords as possible input for credential-stuffing attacks.
The Attack Technique
Adventure has given only brief descriptions of the root causes:
- Main breach: Attackers "illicitly operated" some of Skyticket's administrative functions and pivoted from there to other servers and cloud data stores. The company has not said how they reached those functions. Stolen admin credentials, a missing authentication check and an exposed admin interface are all possible, and none has been confirmed. Moving from an application admin panel into cloud storage suggests the application's credentials or access rights reached further than they should have.
- Business management system: Adventure says only that attackers exploited "a vulnerability." It has not named a product, a CVE or a vulnerability class.
- Bus booking pages: This was a missing access check. Confirmation pages loaded without a login, which is a textbook broken access control or insecure direct object reference (IDOR) flaw, and they were collected automatically.
MKUltraman notes that JPCERT/CC's warning about this autumn's breaches named internet-wide scanning as its first attack pattern. That post's excerpt is cut short, and it does not tie the warning to Skyticket specifically. No IOCs, malware or ransomware have been reported for this incident.
What Organizations Should Do
- Take admin functions off the public internet. Put application admin panels behind a VPN or zero-trust access, require phishing-resistant MFA, and log every admin action. Alert on bulk exports and unusual queries.
- Limit what an application can reach in the cloud. Give application and admin roles narrowly scoped, short-lived credentials. One compromised admin function should not be able to read whole cloud storage buckets. Check IAM policies and storage access logs now.
- Test access control on every customer-facing page. Confirmation, receipt and itinerary pages must check the session and ownership on the server. Avoid sequential or guessable IDs, and rate-limit and alert on bulk enumeration patterns.
- Patch and watch internal business systems. Include back-office and refund systems in vulnerability scanning and patch SLAs. These systems often hold the most sensitive data, such as bank details, and get the least attention.
- Store passwords with a modern algorithm and plan for a dump. Use salted, memory-hard hashing (Argon2id or bcrypt). Prepare forced reset and breached-password checks before you need them.
- Prepare for impersonation and protect your own customers. Travel and transport firms whose brands Skyticket customers know should expect lookalike phishing. Enforce DMARC at
p=reject, publish official contact channels, and brief support staff to spot refund and rebooking scams. Skyticket members should change their password now, as well as any other account that uses the same one.
Sources: Skyticket Breach Exposes Data of 14.6 Million Customers - IT Securi... | 不正アクセスによるお客様情報の流出に関するお詫びとお知らせ 株式会社アドベンチャー | Data leak at travel companies could impact millions of customer rec... | skyticket Data Breach in Japan: 14.6 Million Customer Records Taken... | Blood in the water: Japan's neglected basics are visible from a mil... | Adventure, Inc. — Notice of Information Leakage and Recurrence Prev... | 「skyticket」運営の株式会社アドベンチャーに不正アクセス、顧客情報約1,464万件が流出｜サイバーセキュリティラボ | Japan's Adventure reports data breach affecting 14.6m customer reco...