MediumII Cyber Warfare & Critical Infrastructure9 October 2026, Friday

Breach at hotel booking system Temairazu puts 4.45 million guests at risk

Temairazu, which supplies booking management software to Japanese hotels, said on 9 October that unauthorised access may have exposed or extracted the booking details of up to about 4.45 million guests.

Location: TOKYO

The company says the incident came to light on 21 September, when several hotels reported that suspicious messages had been sent to their guests. Some system functions were temporarily suspended on 24 September. The company announced the incident on 28 September, issued a second statement on 7 October and gave the number of people affected on 9 October. Data at risk include names, phone numbers, email addresses, hotel names, check-in and check-out dates and room rates. The company says it does not hold card details or booking site login credentials.

In this case the leaked data has already moved into a second phase of use. Cybersecurity-jp reported on 11 October that guests are receiving WhatsApp, email and SMS messages posing as hotels or booking sites. The messages ask for card details or payment on the pretext of pre-registration or securing a booking. The company has not disclosed the entry point or attack method, citing security; as of 9 October it said it had notified the Personal Information Protection Commission and contacted the police.

The 4.45 million figure is an upper bound; the company has not confirmed that data on all of these people was taken. Sources differ on the fields exposed: Jiji's 9 October report lists names, phone numbers and booking details, while Traicy's 10 October report adds email addresses. The number of hotels affected had not been disclosed as of 11 October; that item could not be verified.

Talay assessment

Bottom line

The Temairazu case shows the second face of Japan's leak wave: data is not just stolen but, since 21 September, turned directly into fraud through fake messages. Because the attack hit booking software used by many hotels rather than a single hotel, the number of victims grows regardless of the number of hotels. The likeliest path is that the figure stays at the upper bound while the phishing wave runs for several more weeks.

Likely effects

Tourism and hospitalityNegativeWeeks
Guests stop trusting even genuine hotel messages, forcing hotels to rebuild flows that send pre-registration and payment links.
Payments and card fraudNegativeWeeks
No card data leaked, but cards entered on fake payment pages create a new pool for fraud and raise chargeback volumes for card issuers.
Software supply chainUncertain1–6 months
A flaw at a single SaaS provider hits hundreds of customers at once; hotel chains will move to write supplier audits into contracts.

Possibilities, ranked

1
Stays at upper bound, phishing continues60%
A final figure below 4.45 million is announced, but the wave of fake messages runs on for weeks.
Watch: The company's final count of people and hotels affected after an external review
2
Turns into card fraud25%
Card losses from fake payment pages are reported, and card issuers and police issue separate warnings.
Watch: A Temairazu-related fraud warning from Japanese card issuers or the National Police Agency
3
Data put up for sale15%
Booking data is published on a leak site or forum, turning the incident into a personal safety risk.
Watch: A group advertising Temairazu data on a leak site

Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.

Market reaction

Indicators affected

Guests at risk (upper bound)▼ 4.45 million
Detection to disclosure of figure▼ 18 days