Rakuten Group announced that third-party unauthorized access had occurred on Rakuten Travel's overseas hotel booking site and multilingual booking site. The affected data covered up to approximately 2.6 million users on the overseas site and up to approximately 860,000 users on the multilingual site. The company said the data may have included partial credit card information.
Rakuten Group announced that it had confirmed unauthorized access by a third party to the overseas hotel booking site and multilingual booking site of its travel booking service, Rakuten Travel. The affected data covered up to approximately 2.6 million users of the overseas hotel booking site and up to approximately 860,000 users of the multilingual booking site.
On the overseas hotel booking site, an anomaly was detected on 10 September, the cause was identified on 15 September and system modifications were completed on 16 September. The affected information included the names, email addresses, telephone numbers and internal identification numbers of users who were logged in. Booking information, country of residence and information on travel companions for up to approximately 40,000 users who had made bookings through the site were also affected.
The company said the data did not include full credit card numbers, security codes, passwords, identity document information or addresses. The affected regions were Europe, the Americas and Canada, and certain countries and regions in Asia and Oceania.
On the multilingual booking site, the possibility of unauthorized access was detected on 20 October, the cause was identified the same day and system modifications were completed on 21 October. The affected data included the email addresses and internal identification numbers of up to approximately 860,000 users, as well as the account names, email addresses and internal identification numbers of accommodation facility employees.