{
  "id": "club-tourism-members",
  "url": "https://ohshit.app/incidents/club-tourism-members/",
  "title": "Club Tourism warns 4.32 million membership records may have leaked",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-10-31",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Club Tourism",
    "data breach"
  ],
  "ecosystems": [
    "web"
  ],
  "summary": "Club Tourism confirms unauthorized server access and possible exposure of about 4.32 million online membership records. It excludes passwords, passport, card and bank-account data, has stopped its homepage and will notify affected customers. Exact exfiltration remains under investigation.",
  "splash": "Registered Club Tourism internet members; the company excludes customers who never registered",
  "wipe": "Verify notices through established channels, watch for phishing and replace reused passwords",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify unexpected contact",
      "hint": "Use a known official channel to verify messages. Do not open suspicious links or attachments or provide credentials or financial details to purported support."
    },
    {
      "title": "Replace passwords reused elsewhere",
      "hint": "The company excludes login passwords from the possible exposure but recommends changing reused passwords elsewhere as a precaution. Use unique passwords and enable MFA where available."
    },
    {
      "title": "Report suspicious contact or related harm",
      "hint": "Verify the dedicated support number in the original notice, 0120-335-255, before calling. Report suspicious contact or activity through that channel; do not reply to unsolicited messages offering help."
    }
  ],
  "sources": [
    {
      "name": "Club Tourism original customer notice",
      "url": "https://www.club-tourism.co.jp/jpn/news/2026/1031/",
      "says": "October 31 notice confirms intrusion; about 4.32 million records potentially exposed, not confirmed exfiltrated.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "The operator confirms unauthorized access; data exfiltration remains possible, not final.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 30, 2026",
      "title": "Club Tourism detects unauthorized server access"
    },
    {
      "date": "Oct 31, 2026",
      "title": "Company warns of possible exposure of about 4.32 million membership records"
    }
  ],
  "body_markdown": "Potential fields include names, nationality, gender, birth date/age, addresses, phones, email, membership IDs and emergency contacts. The operator excludes passwords, passports, cards and bank-account numbers. Millions of potentially exposed records justify L4; this is not a confirmed count of unique victims.\n\nThe company reports isolation, blocking and corrective work, with investigation continuing. No specific secondary harm is confirmed."
}