Club Tourism said on October 31 that unauthorized access from outside may have leaked personal information on about 4.32 million internet members, including names, nationalities and emergency contact details.
The data covered by the possible leak is held on customers registered as members of the company's online booking system. It includes name, nationality, sex, date of birth and age, address, phone number, email address, member ID and emergency contact details.
Customers who never registered as online members are not affected. Passwords, passport information, credit card details and bank account numbers were not among the data, the company said.
Emergency contacts are often people who never signed up for the service, which can put the exposure beyond the registered membership itself.
Detection and response
Club Tourism detected the unauthorized access at 5:45 a.m. on October 30. Its investigation confirmed that information may have leaked outside the company.
The company isolated the server that was accessed and cut off communications from the source of the attack. It said it identified the route and method of entry and fixed the problem, and will continue investigating with the help of investigative and related organizations.
The website is down to prevent further damage and allow the investigation. Club Tourism plans to restore it once it has reconfirmed that the site is safe.