Club Tourism said on 31 October that an intrusion detected early on 30 October may have exposed about 4.32 million member records including names, nationality, dates of birth, addresses, phone numbers, emails and emergency contacts, and took its website offline. The same day NTT Data said a digital-securities SaaS operated by a subcontractor was accessed without authorisation and suspended its bondholder benefits service; Rakuten Securities cites 362 records, Kintetsu Group Holdings 2,678 and JR West two, with the subcontractor unnamed.
From developments to evidence and analysis
Background
No explicit relationship is recorded.
Evidence
No explicit relationship is recorded.
Follow-ups / later versions
No explicit relationship is recorded.
Related questions
Cite this article
AI & Security Observatory（2026-10-31）「クラブツーリズムで会員約432万件、NTTデータ委託先のSaaSで社債購入者情報の漏えいの可能性 委託先経由の侵害が続く」『AI & Security Observatory』、第1.0版、最終更新2026-11-02。https://ai-security-observatory.org/ja/brief/brief-20261102-18/
AI & Security Observatory (2026-10-31). Club Tourism reports a possible leak of about 4.32 million member records and an NTT Data subcontractor's SaaS exposes bond-buyer data, as supply-chain breaches continue in travel and finance . AI & Security Observatory, version 1.0. Updated 2026-11-02. https://ai-security-observatory.org/en/brief/brief-20261102-18/
Version 1.0 · Publication date 31 Oct 2026 · Updated 2 Nov 2026
Revision history
- Earlier revisions have not been recorded.