skyticket breach exposed 14.6M records, 4.1M passwords and 17,780 bank accounts

On October 9, 2026 Adventure Inc., operator of the Japanese comparison-booking site skyticket, announced that customer data had leaked through three separate unauthorized routes. The largest: between October 2 and 4 an admin function of skyticket was manipulated to reach data stored on other servers and in the cloud, affecting about 14.64 million customer records — names as written in passports, dates of birth, emails, phone numbers, postal addresses and bank-transfer remitter names — of which about 4.13 million included members' hashed login passwords.

The second incident hit the business management system on September 20 via an exploited vulnerability, found September 28: refund bank-account details — bank, branch, number, holder name — for 17,780 records including duplicates. The third: bus booking completion pages were viewable without login and were machine-viewed between August 3 and October 1, exposing about 12,000 bookings including companions' names, ages and sexes. The company confirmed credit-card numbers, which it does not store itself, and passport images were not leaked.

Discovery was staggered — September 28, October 1 and October 5 — and the response was too: the company stopped payments with saved cards and disabled the card-saving feature at 18:00 on October 7, emailed affected customers from about 19:00 on October 8, and published the full notice on October 9, warning that fake 'refund' messages would follow the leak.

About 14.64M records including 4.13M hashed passwords; 17,780 refund bank accounts; ~12,000 bus bookings; card-saving feature switched off.

The server intrusion started from a manipulated admin function — privileged internal tooling was the entry point, not the public storefront.

Refund bank details sat in a business management system with an exploitable vulnerability — a secondary data store carrying the most dangerous fields.

Bus completion pages rendered full booking data without requiring login, so bulk viewing needed no credentials at all.

An abused admin function, an unpatched business system and a booking page left viewable without login: every auxiliary store of customer data is its own attack surface.

Adventure blocked the access routes after detection and says it is continuing the investigation and strengthening its information management. Japan's Personal Information Protection Commission warned about large data leaks on October 7, and the National Cybersecurity Office told businesses on October 9 it had seen several recent large personal-data thefts. The company told customers the only genuine contact is info@skyticket.com and it will never ask for money, passwords or PINs — anticipating the phishing wave a leak of names, addresses and bus itineraries enables. No fine has been announced.