Rakuten Travel unauthorized access may have exposed up to 2.6 million records

Rakuten Group announced on October 26, 2026 that it had confirmed unauthorized access by a third party to certain pages of the overseas hotel booking website of its travel service Rakuten Travel, operated by its subsidiary Rakuten Travel Xchange, and to its multilingual booking website. On the overseas booking site, an anomaly was detected on September 10, the cause was identified on September 15, and system fixes were completed on September 16. The affected information included booking information (names, email addresses, telephone numbers, countries of residence, internal identification numbers, property names and booking amounts) for up to about 40,000 reservations, including partial payment information for up to about 36,000 of them, limited to the card issuer identification number and last four digits, the cardholder name, the expiration date and the card brand. Full card numbers, security codes, passwords, passport information and addresses were not included. The company also says the names, email addresses, telephone numbers and internal identification numbers of up to about 2.6 million users who logged in to the affected pages were affected.

For the multilingual booking website, possible unauthorized access was detected on October 20, the cause was identified the same day, and fixes were completed on October 21, affecting the email addresses and internal identification numbers of up to about 860,000 users and the account details of up to about 40,000 accommodation facility employees. Rakuten says it has blocked the access route, reported the matter to Japan's Personal Information Protection Commission and relevant overseas authorities, and confirmed no secondary damage or impact on other services so far, and that the affected information alone cannot be used for fraudulent payment transactions. Affected users will be contacted individually. All of the figures above are stated by the company as maximums (up to), and BigGo Finance states the combined scope as up to 2.6 million records in total. Because the count is a stated maximum potential exposure, not a confirmed count of records taken, SecurTek lists this breach without adding that figure to the records exposed total, and will update the item when a confirmed count is published.

Sources: TRAICY Global; BigGo Finance