HIS reports potential leak of 627 passport records via Thai subsidiary

Travel agency HIS announced on October 7 that a data breach at its Thai subsidiary, H. I. S. TOURS CO., LTD., may have compromised the passport information of up to 627 individuals. The leaked data includes names (alphabetical and signature), gender, dates of birth, passport numbers, expiration dates, and allergy information. Contact details such as phone numbers, addresses, email addresses, and credit card information were not affected.

The breach was initially detected by security software on December 11, 2025. While the company reported the incident to the Personal Information Protection Commission and JIPDEC in late December 2025, the full extent of the passport data leak was not confirmed until February 24, 2026. The delay in public disclosure has drawn criticism, with some suggesting the company waited too long to inform the public.

HIS attributed the delay to the complexity of the data on the affected file server. The company stated that because personal information was mixed with large volumes of unrelated accounting records in various file formats, they had to perform manual verification to ensure accuracy. The affected customers are those who traveled to Thailand through HIS during specific periods in 2017, 2019–2020, and 2024–2025.