Club Tourism warns 4.32 million membership records may have leaked
Club Tourism confirms unauthorized server access and possible exposure of about 4.32 million online membership records. It excludes passwords, passport, card and bank-account data, has stopped its homepage and will notify affected customers. Exact exfiltration remains under investigation.
- Disclosed
- Oct 31, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Registered Club Tourism internet members; the company excludes customers who never registered
- web
- In the wild
- Yes
- The operator confirms unauthorized access; data exfiltration remains possible, not final.
What happened
Potential fields include names, nationality, gender, birth date/age, addresses, phones, email, membership IDs and emergency contacts. The operator excludes passwords, passports, cards and bank-account numbers. Millions of potentially exposed records justify L4; this is not a confirmed count of unique victims.
The company reports isolation, blocking and corrective work, with investigation continuing. No specific secondary harm is confirmed.
Crime-scene timeline
Oct 30, 2026
Club Tourism detects unauthorized server access
Oct 31, 2026
Company warns of possible exposure of about 4.32 million membership records
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Club Tourism original customer noticePrimaryOctober 31 notice confirms intrusion; about 4.32 million records potentially exposed, not confirmed exfiltrated.