Rakuten Travel faces potential leak of 3.5 million customer records

Rakuten Group has reported unauthorized access to its travel booking services, potentially exposing up to 3.54 million pieces of customer information. The breach involves two distinct incidents affecting different platforms.

In the first incident, which was detected on September 10, unauthorized access occurred on pages operated by Rakuten Travel Xchange. This breach potentially compromised the names, email addresses, and phone numbers of up to 2.6 million users. Additionally, booking details for approximately 40,000 customers—including residence, accommodation names, and booking amounts—were targeted. This subset includes roughly 36,000 records containing credit card information, specifically card issuer identifiers, the last four digits of the card number, cardholder names, expiration dates, and card brands. Rakuten stated that full card numbers, CVV codes, passwords, and passport numbers were not included.

A second incident involving a multilingual booking site was detected on October 20, potentially exposing the email addresses and internal identification numbers of up to 860,000 users, as well as account names and emails for 40,000 accommodation staff members.

While the primary breach affected regions including Europe, North America, Asia, and Oceania, Rakuten noted that South Korea, Taiwan, Hong Kong, and Singapore were excluded from the first incident's affected regions. The company has blocked the access routes, updated its systems, and notified relevant data protection authorities.