Major travel agency HIS has announced that passport information for up to 627 individuals may have been leaked due to unauthorized access to its local subsidiary in Thailand. The background behind this incident includes the hollowing out of data management practices on overseas subsidiary servers, as well as delays in corporate readiness for cyber-related legislation set to be tightened in 2026.

Key points of the unauthorized access resulting in the leak of 627 passport records

On October 7, 2026, major travel agency HIS announced that a file server belonging to its Thai local subsidiary, “H.I.S. TOURS CO., LTD.,” had suffered unauthorized access by a third party, and that customer passport information and other data for up to 627 individuals may have been leaked externally. Passport information is official data carrying a high risk of being abused for forgery and impersonation, sending shockwaves throughout the entire tourism and travel industry.

The information that may have been leaked this time is as follows:
– The alphabet name on the passport and the name in the signature field
– Gender, Date of Birth, Passport Number, Passport Expiry Date
– Health-related data, such as allergy information, associated with tour arrangements
– Passport image data for a portion of target customers (approximately 10%)

The affected individuals are customers who departed for Thailand using the company’s services in 2017, from 2019 to 2020, and from 2024 to 2025. Specifically, this includes individual travelers who stayed at the Pullman Hotel in Bangkok and participated in the Chiang Mai Yi Peng Festival in November 2024, as well as group travelers from the respective periods. Meanwhile, credit card information, phone numbers, addresses, and email addresses were not stored on the server in question and are considered exempt from the leak. While no secondary damage has been confirmed at this time, the company has established a dedicated hotline and is issuing warnings.

Detailed Timeline from December 2025 Detection to October 2026 Public Announcement

What has sparked intense debate among market participants and users in this incident is the lengthy period of approximately 10 months it took from the initial detection of the unauthorized access to the official announcement. The timeline from the occurrence of the incident to the completion of the response is organized as follows.

• December 11, 2025: Detection software issued an alert on the file server of the Thai subsidiary, and because unauthorized access was discovered, the server was disconnected from the network.
• December 29, 2025: Confirmed that potentially exfiltrated data contained personal information acquired domestically, and reported the matter to the Personal Information Protection Commission and JIPDEC.
• February 24, 2026: A forensic investigation by external experts revealed the existence of passport information for up to 627 individuals, and a detailed review of all files has begun.
• October 7, 2026: All file matching has been completed, and individual notifications to affected individuals as well as a public announcement on the website have been carried out.

Although network isolation and reporting to administrative authorities were carried out promptly in the initial response phase, the significant delay in notifying the victims themselves and making a public announcement has called the company’s approach to crisis communication into question. The following figure illustrates the structure of incident response.

Factors behind publication delays due to a mix of unstructured data and manual review

The background behind the fact that it took an additional seven months or more from the initial investigation to the public announcement lies in structural flaws within the data storage environment of an overseas subsidiary. Inside the targeted file server, a massive amount of unrelated data was intermingled, including not only customers’ personal information but also the local corporation’s accounting records and routine administrative documents. Furthermore, because data formats and file extensions were not standardized and were stored haphazardly as unstructured data, keyword searches and automated system extraction were impossible.

As a result, dedicated staff were forced to manually review each and every file and cross-reference them against wanted lists and image data. Furthermore, the fact that past traveler data from years such as 2017 and 2019 remained undeleted signifies a failure in data lifecycle management (DLM). Leaving sensitive information whose intended use had expired unattended for an extended period resulted in the unnecessary expansion of the attack surface for attackers.

The Surge of Cyber Threats Surrounding Businesses and Their Underlying Factors

Information Leak Incidents Affecting Major Services Occurring One After Another Since Late September

Since late September 2026, there has been a string of announcements in Japan regarding unauthorized access and large-scale data leaks targeting prominent companies and major services. Going beyond the HIS incident, serious security incidents are occurring across a wide variety of industries, raising a growing sense of alarm in society.

Major recent incidents and attack trends are as follows.
– Leak of driver’s license images in Times Car Share and the movement toward a class-action lawsuit
– Massive personal data leaks involving millions of records at Yakiniku King and BookOff
– Attacks targeting shared SaaS platforms and consumer-facing web services
– Increased risk of secondary attacks combining identity information such as credentials and facial photographs

Security experts analyze that, rather than being a series of attacks by a single attacker, it is largely due to the timing of investigations and public disclosures overlapping across many companies simultaneously. However, the structural shift in which cloud services and web applications aggregating massive amounts of customer data are being targeted as efficient targets is clear, making countermeasures an urgent priority regardless of company size. The following image illustrates changes in corporate security perimeters.

The Growing Criminal Value and Vulnerabilities in External Access Paths

The fundamental reason behind the rapid surge in cyberattacks is that the criminal value derived from acquired personal information has increased remarkably in recent years. By combining not just names and contact information, but also driver’s license numbers and passport images—which are difficult to change—along with recent purchase and travel histories, the risk of these details being exploited for unauthorized cryptocurrency account openings and sophisticated phishing scams increases exponentially.

Furthermore, according to statistics from the National Police Agency, more than 80% of intrusion routes into corporations originate from externally exposed remote access paths such as VPN devices and Remote Desktop (RDP). The latest security patches were not applied on approximately half of the compromised devices, and small and medium-sized enterprises (SMEs) account for over 60% of the affected companies. In the majority of cases, the direct cause of the breach is not sophisticated methods like zero-day attacks, but rather basic security deficiencies such as unapplied security patches, the lack of multi-factor authentication, and neglected unnecessary accounts.

The 2026 New Cyber Law and Legal and Practical Measures Required for Businesses

The Act on Strengthening Cyber Response Capabilities Taking Effect in October 2026 and the SCS System

From a legal standpoint, the “Act on Strengthening Cyber Response Capabilities,” which took effect on October 1, 2026, became a major milestone in Japan’s cybersecurity. Under this law, critical infrastructure operators are required to submit notifications regarding specified critical computers and report upon the occurrence of incidents, establishing a framework in which administrative penalties or punishments are imposed in the event of violations.

Furthermore, regulatory reforms to ensure the security of the entire supply chain are progressing.
– SCS Evaluation System: A Japanese security evaluation system operated by the IPA that evaluates the IT infrastructure of supply chain companies at levels ranging from ★3 (self-evaluation) to ★4 (third-party evaluation).
– Evaluation standardization: Operations are scheduled to begin around the end of fiscal 2026, with a growing trend among major enterprises to make obtaining it a contractual requirement for contractors and suppliers.
– Redesigning Contract Clauses: It has become standard practice to incorporate the maintenance of SCS standards, incident notification obligations, and the requirement to submit an SBOM (Software Bill of Materials) into outsourcing contracts.

Although the system itself is voluntary, it functions as a de facto trading qualification, making it an unavoidable management challenge for small and medium-sized enterprises (SMEs) and subcontractors as well. The figure below shows the overall picture of the legal system and corporate supply chain control.

Future Developments and Governance Enhancement Required of Management

Moving forward, the era is approaching where it will no longer be enough to simply check formally whether “security measures have been implemented”; rather, it will be demanded whether management can prove through objective logs and minutes that they exercised reasonable oversight when an incident occurred. In today’s world, where the vast majority of intrusion vectors are clear from public statistics, if a data breach occurs as a result of neglecting basic countermeasures, there is an extremely high risk that directors will be held legally liable by shareholders and business partners for a breach of the duty of care of a prudent manager (Article 330 of the Companies Act).

Looking ahead, key areas for companies to focus on are as follows:
– Building a zero-trust environment for the entire group, including overseas subsidiaries and contractors
– Implementation of a data discovery tool that automatically deletes personal data whose purpose of use has ended
– Regular reporting of security management status at board meetings and documentation of corrective action decisions
– Revamping Crisis Communication Standards to Enable Rapid and Phased Information Disclosure

Cybersecurity is not merely a technical challenge for the IT department, but a paramount management risk that the board of directors must oversee. There is a strong demand for a fundamental review of organizational structures in anticipation of strengthened governance for overseas subsidiaries and legal revisions.

Reference page

• [Security Measures Evaluation System for Strengthening Supply Chains] [suspicious link removed]

[#UnauthorizedAccess #DataBreach #HIS #Cybersecurity #CyberSecurityAct #SCSsystem #CorporateLegal]