In short: Japanese hotel reservation software provider Temairazu disclosed unauthorized access to its platform affecting up to 4.45 million bookings. Attackers obtained guest names, phone numbers, emails and hotel names (no card data was exposed), and hotels are now reporting phishing emails disguised as official booking confirmations sent to affected guests.
For anyone who books accommodation online and routinely hands over personal details to a reservation platform, this is another reminder that the breach happens on the service's side, not the traveler's — and the best defense combines caution with suspicious emails and basic connection hygiene, whether you're traveling abroad or checking a confirmation on hotel Wi-Fi.
What happened
On September 21, 2026, several hotels using the TEMAIRAZU booking system reported that guests with reservations had received suspicious messages. An investigation confirmed third-party unauthorized access to the platform. According to NHK television, the incident may have affected roughly 4.45 million reservations — the scale of records the system processes across a large network of hotels and guesthouses nationwide.
What data was exposed
According to the company, attackers accessed guest names, phone numbers, email addresses, contact details, hotel names, check-in/check-out dates, and accommodation charges. Temairazu specifically emphasized that its system does not store credit card data, so there is no direct risk of fraudulent charges from this breach.
Why this is more than "just a leak"
What makes this incident worse than the breach itself is what happened next: hotel guests began receiving fake emails posing as the hotels themselves, asking them to "confirm" reservation details or payment information. This is a textbook post-breach phishing pattern — attackers use stolen names, emails and real hotel names to make the lure far more convincing, since the recipient genuinely did book a room there.
Company response
Temairazu said it identified the source of the breach, implemented additional access controls and enhanced monitoring, engaged outside security specialists for an independent investigation, and reported the incident to Japan's Personal Information Protection Commission and the police.
How to protect yourself if you've booked through a similar service
- Don't click links in emails "from your hotel" asking you to "confirm" a booking, card details, or passport info — call or message the hotel directly using the number on its official website.
- Check the full sender address, not just the display name — spoofed emails often use a similar-looking but different domain.
- If you already have the original confirmation in your inbox, compare details (dates, booking number) against the new message — mismatches are a clear sign of a fake.
- Use different passwords across booking platforms: after breaches like this, attackers commonly try stolen emails paired with reused passwords on other sites.
A separate layer of protection is controlling your own network traffic. The Temairazu leak happened on the service's side, and a VPN wouldn't have prevented it — but when you're completing a booking or checking email on hotel or airport Wi-Fi, encrypting your connection with LiMP VPN stops others on the same network from intercepting your traffic. Plans start at 69 ₽/month — see pricing.