Leakage of customer information due to unauthorized access
株式会社アドベンチャー
Comparison and reservation website skyticket, skyticket's servers, business management system, and bus reservation service
(1) Certain administrative functions of skyticket were manipulated without authorization, resulting in unauthorized access to data stored on other servers and in the cloud. (2) Vulnerabilities in the business management system were exploited. (3) Bus reservation completion pages could be displayed without logging in and were viewed mechanically by third parties.
Company response
Payments using stored credit cards and the card information storage function. Suspended from around 18:00 on 7 October 2026.
The Company is conducting an investigation and implementing countermeasures. Information regarding a third-party committee, special investigation committee or similar body: Not disclosed
The routes used for unauthorized access have been blocked and measures have been implemented to address the vulnerabilities. The bus reservation completion page was corrected on 1 October. The entire Company is working to prevent recurrence and strengthen its information management framework.
Related procedures
Report to the Personal Information Protection Commission
Personal Information Protection Commission
The impact of this incident on the performance of the Company Group is currently under review. If matters requiring disclosure are identified, they will be disclosed promptly.
The investigation will continue, and any new facts identified will be reported promptly. The entire Company will work to prevent recurrence and strengthen its information management framework.
Any new facts identified will be reported promptly.
| Item | Details |
|---|---|
| Event name | Leakage of customer information due to unauthorized access |
| Date of occurrence | (1) 2-4 October 2026, (2) 20 September 2026, (3) 3 August-1 October 2026. In addition, unauthorized login to 1 member's account was confirmed on 9 September 2026. |
| Date recognized / date notice received | (1) 5 October 2026, (2) 28 September 2026, (3) 1 October 2026 |
| Subject Entity | 株式会社アドベンチャー |
| Target Locations / Products | Comparison and reservation website skyticket, skyticket's servers, business management system, and bus reservation service |
| Cause | (1) Certain administrative functions of skyticket were manipulated without authorization, resulting in unauthorized access to data stored on other servers and in the cloud. (2) Vulnerabilities in the business management system were exploited. (3) Bus reservation completion pages could be displayed without logging in and were viewed mechanically by third parties. |
| Impact on Earnings Forecast | The impact of this incident on the performance of the Company Group is currently under review. If matters requiring disclosure are identified, they will be disclosed promptly. |
| Type of litigation or proceeding | Report to the Personal Information Protection Commission |
| Court or authority | Personal Information Protection Commission |
| Suspended operations | Payments using stored credit cards and the card information storage function. Suspended from around 18:00 on 7 October 2026. |
| Investigation structure | The Company is conducting an investigation and implementing countermeasures. Information regarding a third-party committee, special investigation committee or similar body: Not disclosed |
| Measures to prevent recurrence | The routes used for unauthorized access have been blocked and measures have been implemented to address the vulnerabilities. The bus reservation completion page was corrected on 1 October. The entire Company is working to prevent recurrence and strengthen its information management framework. |
| Outlook | The investigation will continue, and any new facts identified will be reported promptly. The entire Company will work to prevent recurrence and strengthen its information management framework. |
| Planned follow-up disclosure | Any new facts identified will be reported promptly. |
Items this document does not state (11)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.Certain administrative functions of skyticket were manipulated without authorization, allowing access to data on other servers and in the cloud; vulnerabilities in the business management system were exploited; and bus reservation completion pages could be displayed without logging in.