Club Tourism's 4.32 million members and GMO Trust Login's 2,492 companies: what two late-October leaks mean for your company this week

Key points for company leaders

This article reflects information available on the morning of 2 November 2026 (Japan time). The Club Tourism case is at its first report and still under investigation. For the latest, check the announcements listed in the sources at the end.

• Club Tourism: about 4.32 million records

  Club Tourism detected unauthorised outside access at 5:45 on 30 October. Records for about 4.32 million members registered with its online booking system may have leaked, including names, addresses, phone numbers, email addresses, dates of birth and emergency contacts.^[1]

• What was not included

  The company says login passwords, passport details, credit card data and bank account numbers were not included, and no secondary harm has been confirmed so far.^[1]

• GMO Trust Login: about nine years exposed

  At GMO GlobalSign's ID management service GMO Trust Login, a configuration error left files containing customer data reachable from outside from around 14 November 2017 to 15 September 2026. Files confirmed taken by a third party cover 2,492 companies and 45,030 people.^[2]

• What to do this week

  Tell all staff and the people who handle partner accounts not to enter IDs or passwords in response to messages that claim to come from either company or that mention contract renewals or licence overages. Also check that nothing sensitive sits in storage your company publishes on the web.^[1][2]

What happened at Club Tourism

On 31 October the travel company Club Tourism announced that part of its server environment had been accessed without authorisation from outside and that some customer data may have leaked. Those affected are online members of its internet booking system; people who never registered as members are not affected.^[1]

The items that may have leaked are name (kanji and kana), nationality, gender, date of birth and age, address, phone number, email address, member ID and emergency contact. The company says it isolated the affected server, cut off traffic from the attacker, and identified and fixed the intrusion route and method. It has taken its website offline while it investigates, consulted the police, and reported to the Personal Information Protection Commission and its supervising ministry. Its parent company, KNT-CT Holdings, also issued an apology on 1 November.^[1][3]

What happened at GMO Trust Login

GMO Trust Login is an ID management service that lets employees sign in to many business services with a single login. On 30 October GMO GlobalSign published its third report with the results of an investigation by an outside specialist firm.^[2]

According to the company, part of its storage was used as a public area that anyone could view, to deliver images such as the service logo. Files that the system created when administrators ran bulk operations in the admin screen, plus contract information files, were stored there too, and individual files could be fetched from the file listing. The file links had no signature or expiry. Regular assessments and penetration tests covered the application and servers but not the storage, which is why the problem went unnoticed for so long. It came to light on 14 September 2026, when an outside security researcher reported it through the company's vulnerability disclosure programme.^[2]

The files taken contained email addresses, names, the names of connected services, fields such as employee numbers and departments, and billing contacts' names, addresses, phone numbers and email addresses. The company says login passwords, security questions and answers, multi-factor authentication data, passwords for connected services and payment data were not included.^[2]

Timeline

How the two cases differ

What to check at your company

• Told all staff not to give IDs, passwords or bank details in response to calls, emails, texts or letters that claim to come from Club Tourism or GMO^[1][2]
• Told staff to verify any request for payment or credentials about contract renewals, licence overages or account checks through the usual contact channel^[2]
• Told the billing team to confirm any change of bank details using contacts already on file
• Listed the cloud storage your website and apps use, and checked its public settings and contents^[2]
• Made file links expire or require a signature, and hid file listings from outsiders^[2]
• Extended outside assessments beyond apps and servers to storage and every internet-facing asset^[2]

Common questions

How ZeroKai can help

The GMO Trust Login case shows how public storage left out of assessment scope went unnoticed for about nine years. Knowing everything your company exposes to the internet, in one list, is the first step to fewer blind spots. ZeroKai takes your domain, lists the host names recorded in Certificate Transparency logs and highlights names that look like admin screens or test environments. For domains whose ownership you have verified, it also shows exposed remote access, file sharing, database and FTP services observed by Shodan.