In short: On October 9, 2026, Adventure, the operator of Japanese flight-booking service Sky Ticket, disclosed unauthorized external access to its systems. According to the company, the data of up to 14 million customers may have been exposed — names, dates of birth, postal addresses, phone numbers, bank account details, and passwords. The company apologized and began emailing customers urging them to change their passwords immediately.
What happened
Sky Ticket is one of Japan's larger flight-search and booking aggregators. According to Adventure, attackers gained unauthorized access to the service's internal systems, potentially compromising data belonging to roughly 14 million users. The leaked data set went beyond contact details to include bank account information and passwords — enough for both direct financial fraud and large-scale credential-stuffing attempts against other sites where people reuse the same password.
Why this isn't an isolated case
The Sky Ticket incident is one of several major breaches Japanese companies disclosed within a single week in October 2026: similar leaks hit resale retailer Book Off (about 6.4 million users) and booking service Temairazu (4.45 million customers). Industry trackers note that cyberattacks against Japanese corporate information systems topped 600 cases in the first nine months of 2026 alone — a record figure that experts partly attribute to a rise in automated, AI-assisted attacks.
What this means for everyday users
If you have a Sky Ticket account, or reused the same password elsewhere, this calls for action rather than panic. The bigger risk isn't the breach itself — it's password reuse: if the stolen email-and-password combination matches your login for email, a marketplace, or a bank, attackers will test it automatically through credential stuffing. Be especially wary of emails urging you to "urgently confirm your details" or "restore access" — phishing volume reliably spikes after breaches like this one, with messages disguised as official company notices.
How to protect yourself
- Change your Sky Ticket password and any password you reused elsewhere — especially for email and banking apps.
- Turn on two-factor authentication wherever it's available — it protects your account even if the password itself leaks.
- Use a password manager so every service gets its own unique password; our guide on password manager security covers how to set one up and why it matters more than it seems.
- Check whether your own data has surfaced in known breaches using the method in our piece on checking for personal data leaks.
- If you suspect an account is already compromised, step-by-step recovery actions are covered in our guide on protecting an account from a hack.
A VPN doesn't protect data already stolen from a breached server — that calls for a password change and two-factor authentication. But it closes a different risk: interception of your own traffic on open networks, such as when logging into email or banking over public Wi-Fi at an airport or hotel. LiMP VPN runs on a no-logs policy, with plans from 69 ₽/month — details on the pricing page.