# Update: Skyticket Reports Up to 14.64 Million Customer Records Exposed, After Japan's Cyber Office Asked Companies to Treat Security as a Management Issue

Times of AI Desk · 2026-10-09 · Security

[https://timesof.ai/2026/10/japan-urges-cyber-reviews-ai-driven-attack-wave](https://timesof.ai/2026/10/japan-urges-cyber-reviews-ai-driven-attack-wave)

> Updated Oct. 9, evening: Adventure Inc., which runs the travel booking site Skyticket, said on Oct. 9 that an intrusion from Oct. 2 to Oct. 4 may have exposed about 14.64 million customer records, about 4.13 million of them with hashed member passwords, alongside two smaller, separate incidents. It says no card numbers or passport images leaked. The company has not said who was behind it or how the admin functions were abused, and nothing published shows AI was used. Earlier on Oct. 9, Japan's National Cybersecurity Office asked businesses holding large volumes of personal data to tighten security and treat it as a management issue, citing the misuse of AI among increasingly advanced attack methods; it is a request, not a law.

**Updated October 9, 2026, evening:** Travel booking site Skyticket has disclosed that up to 14.64 million customer records may have been exposed. The new section directly below covers it; the afternoon report on the government's request follows, unchanged except that its headings now sit under a dated section and one line in its Limits section has been clarified.

## October 9, evening: Skyticket's disclosure

**Adventure Inc.**, which operates the comparison and booking site **Skyticket**, said on **October 9** that its systems had been accessed without authorisation and that customers' personal information had leaked or may have leaked. Its notice describes three separate incidents, each through a different route:

| | When | How, per the company | Records |
| --- | --- | --- | --- |
| Company servers | Oct. 2–4; found Oct. 5 | Some Skyticket admin functions were operated without authorisation, giving access to other servers and to data stored in the cloud | about **14.64 million** customers, about **4.13 million** of them with member login passwords |
| Business management system | Sept. 20; found Sept. 28 | A vulnerability in the system was exploited | **17,780** (including duplicates; some counts still under investigation) |
| Bus booking service | Aug. 3–Oct. 1; found Oct. 1 | Booking-confirmation pages could be viewed without logging in and were viewed mechanically by a third party; fixed Oct. 1 | about **12,000** bookings |

In the largest incident, the exposed fields are names (including passport spellings), dates of birth, email addresses, phone numbers, postal addresses, the payer name on bank transfers, and member passwords, which the company says were stored hashed. It says passport numbers did not leak in that incident. The business-system breach exposed refund bank-account details. Adventure says it does not store card numbers or passport images, so neither leaked in any of the three. It stopped payments with saved cards at about 6 p.m. on October 7, is contacting affected customers by email, has reported to Japan's Personal Information Protection Commission, and asks members to change their passwords.

The notice does not say who was behind the intrusions, and it does not mention AI.

### Other travel companies, and what investigators say about method

**The Japan Times** reported Skyticket's disclosure alongside two other travel-company incidents. **H.I.S.** said on Wednesday that passport information for up to 627 people may have leaked after unauthorised access at its Thailand-based subsidiary, H.I.S. Tours, in an incident that took place last December. Travel technology company **Temairazu** said on September 28 that a third party had accessed its booking service on September 21.

The day before Skyticket's notice, **The Hacker News** summarised an October 8 alert from **JPCERT/CC** and an October 7 analysis by **Macnica**'s Security Research Center. Macnica counted **119** incidents made public this year through October 6 in which personal data was stolen or leaked through web systems run by organisations in Japan, against 84 in all of 2025 and 62 in 2024. JPCERT/CC described attackers abusing smartphone-app APIs and known flaws, and neither it nor Macnica named a group behind the activity. The Hacker News reports that "no logs or traces prove that AI was used," and that no use of AI-discovered zero-day flaws in common software had been confirmed. Macnica's author still thinks AI use is hard to rule out, because checking so many sites by hand is not realistic.

None of these sources links Skyticket's intrusion to a particular attacker or method beyond what the company describes, and none shows AI was involved.

## October 9, afternoon: the government's request
Japan's government has told companies that a string of data breaches is now a boardroom problem, not just an IT one. On **October 9**, the **National Cybersecurity Office (NCO)** in the Cabinet Secretariat (内閣官房国家サイバー統括室) published a four-page notice asking businesses, especially those holding large volumes of personal or sensitive information, to "promptly consider" tightening their defences. Kyodo News reported that the request went to companies nationwide through the relevant ministries.

### What the notice says

The NCO says it has confirmed multiple cases in which the systems of businesses handling large amounts of personal data were broken into and data, including personal information, was stolen. It names three routes: exploited vulnerabilities in web systems, compromises through supply chains, and data management that lacked robustness.

Its checklist covers three areas:

- **Web systems:** apply security patches promptly, stop using unsupported products, run regular vulnerability assessments, introduce multi-factor authentication, keep and monitor logs, and prepare incident response, on the assumption that internet-facing systems "could be attacked at any time."
- **Supply chains:** check contractors' security, write breach-reporting duties and access controls into contracts, and give contractors only the data they need.
- **Data:** know what information is held, delete what is no longer needed, encrypt stored data, limit access rights, and review access logs for signs of intrusion.

The notice closes with the line that frames the rest: damage from cyberattacks "is no longer a problem for the IT department alone," and, "as cyberattack methods, including the misuse of AI, become more advanced and sophisticated," executives are asked to position cybersecurity as a management issue and strengthen measures, including necessary investment and staffing. Organisations that are hit are asked to share technical information quickly with the NCO, the ministries that oversee them, or specialist bodies.

The document is a request (お願い), not a new legal obligation.

### Who else spoke

- **Ministers:** Cyber security minister **Toshiharu Furukawa** said attack methods "are becoming more sophisticated by the day" and countermeasures need updating, Nikkei reported. Trade minister **Ryosei Akazawa** said his ministry would alert companies broadly through industry groups.
- **The ruling party:** The Liberal Democratic Party's national cybersecurity strategy headquarters met the same day and called for stronger public-private coordination, including a response to increasingly capable AI, per Nikkei. Its head, former digital minister **Masaaki Taira**, called the situation "an emergency in cyberspace." Seoul Economic Daily, relaying Kyodo, quotes Taira as saying recent attacks have taken on the character of "saturation attacks," in which AI is used to repeat assaults automatically at massive scale.
- **The IPA:** Japan's Information-technology Promotion Agency issued its own alert, saying the attacks have not so far been tied to a vulnerability in any specific product or service, and that published cases suggest compromised internet-facing applications, services and accounts as starting points.

### The breaches behind it

Seoul Economic Daily reports that about **6.6 million** items of user personal data at **Times Car**, the country's largest car-sharing operator, were exposed in a cyberattack, and that **Daiwa Securities** and convenience-store chain **FamilyMart** also reported leaks. Japanese security authorities are investigating who was behind the incidents, the methods used and any links between them, the paper says. Bloomberg summarised the government's move as a call for security checks "as AI tools lower the barriers to large-scale hacking."

The AI link is how the LDP's Taira, Seoul Economic Daily and Bloomberg frame the wave; the NCO's own notice lists AI misuse as part of a general rise in attack sophistication and does not attribute any named breach to AI. No perpetrator or method has been published.

## Limits

- October 9, evening: Skyticket's figures and timeline come from Adventure Inc.'s own notice (Japanese; translations ours). The H.I.S. and Temairazu details come from The Japan Times. Macnica's count and JPCERT/CC's alert were read as summarised by The Hacker News; the originals were not opened.
- Quotations from the NCO notice, Kyodo, Nikkei and the IPA are Times of AI translations from Japanese.
- Seoul Economic Daily's article carries a note saying it is "AI-translated from Korean" and that quotes from foreign sources are based on Korean-language reports; it relays Kyodo, so its quotes from Japanese sources may not match the original wording. Taira's "saturation attacks" remark comes only from that relay.
- Bloomberg's report was seen only as its headline and summary.
- The Times Car, Daiwa and FamilyMart details come from Seoul Economic Daily; the companies' own notices were not checked.

## Sources

- [Adventure Inc. (Skyticket): 不正アクセスによるお客様情報の流出に関するお詫びとお知らせ (October 9, 2026, Japanese)](https://skyticket.jp/news/maintenance/67603/)
- [The Japan Times: Data leaks at travel companies could impact millions of customer records (October 9, 2026)](https://www.japantimes.co.jp/business/2026/10/09/tech/travel-companies-data-breach/)
- [The Hacker News: Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks (October 8, 2026)](https://thehackernews.com/2026/10/japan-sees-sharp-rise-in-web-data-leaks.html)
- [National Cybersecurity Office, Cabinet Secretariat (Japan): 不正アクセスによる漏えい等の事案を踏まえた対応について (October 9, 2026, PDF, Japanese)](https://www.cyber.go.jp/pdf/press/taiou.pdf)
- [Kyodo News via d menu news: 政府、企業に情報漏えい対策要請 「経営リスク」に発展の可能性も (October 9, 2026, Japanese)](https://topics.smt.docomo.ne.jp/article/kyodo_nor/politics/kyodo_nor-2026100901001709)
- [Nikkei: サイバー攻撃増、政府が企業に注意喚起 自民党は官民連携の強化要請 (October 9, 2026, Japanese)](https://www.nikkei.com/article/DGXZQOUA0919N0Z01C26A0000000/)
- [IPA: 不正アクセスによる漏えい等の事案を踏まえ、速やかに実施すべき対策等について (October 9, 2026, Japanese)](https://www.ipa.go.jp/security/security-alert/2026/alert20261009.html)
- [Seoul Economic Daily: Japan Urges Firms to Boost Cybersecurity as AI-Driven Attacks Surge (October 9, 2026)](https://en.sedaily.com/international/2026/10/09/japan-urges-firms-to-boost-cybersecurity-as-ai-driven)
- [Bloomberg: Wave of Cyberattacks Prompts Japan to Urge Security Reviews (October 9, 2026; headline and summary only)](https://www.bloomberg.com/news/articles/2026-10-09/wave-of-cyberattacks-prompts-japan-to-urge-security-reviews)