Security · October 18, 2026
Unauthorized Access to Bus Reservation Site May Have Exposed 8,341 Records
On October 15, a company managing a bus reservation site announced unauthorized access to its API server used for partnerships with external vendors led to the leakage of some reservation information.
The compromised data includes Katakana names, phone numbers, travel dates, routes, and reservation numbers for a portion of bookings made between July 16, 2026, and November 29, 2026. The maximum number of affected records is 8,341, involving 5,614 individuals.
Of these, 548 reservations and 448 individuals were specifically related to the bus reservation site. The remaining information pertains to reservation services provided to bus operating companies. Importantly, sensitive data such as credit card details, bank account information, addresses, email addresses, and passwords were not stored on the server.
The company is taking steps to address the situation and prevent further incidents, ensuring that users are informed about the breach and the nature of the exposed data.
This incident highlights the ongoing challenges of cybersecurity in the digital age, especially for services that handle personal information. Companies are urged to implement stronger security measures to protect user data and maintain trust with their customers.
As investigations continue, the company is expected to cooperate with relevant authorities to assess the full impact of the breach and implement necessary safeguards moving forward.