Travel platform MyRealTrip confirms data breach exposing passport numbers and encrypted passwords

MyRealTrip, a travel platform, confirmed that unauthorized external access led to the leakage of personal information belonging to its travelers. The company disclosed the incident on its website, stating that the breach occurred around October 25. The exposed data includes names, email addresses, mobile phone numbers, dates of birth, and gender. Additionally, the breach involved encrypted passwords and, for a subset of users, passport numbers and passport expiration dates. MyRealTrip stated that payment method information, such as credit card details, and reservation or purchase records were not part of the leaked data. The company noted that the specific items leaked may vary from one user to another.

MyRealTrip has not disclosed the exact number of affected individuals, the root cause of the incident, or the specific intrusion path used by the attacker. The company stated that it immediately blocked the abnormal access upon discovery and conducted inspections and reinforcements of the related systems. It reported that it has strengthened its security detection and blocking systems and is continuously monitoring the situation. MyRealTrip also stated that it has completed the necessary reporting to relevant authorities in accordance with applicable laws. The company advised users to change their passwords as a preventive measure, even though the passwords were stored using an irreversible encryption method.