A break-in at Rakuten Travel may have exposed data on up to 2.6 million people.
54.4%
of agree votes went to 36 comments on data hoarding
790 comments read to the bottom · every number is below
The most-agreed comment
Ticket Pia, Yodobashi.com, Amazon and others too - registering your credit card details is compulsory. I think it'd be fine to type it in each time you buy and have the details deleted once payment's done, but the sites force you to register. It lets users pay quickly, and it means they can get you buying easily any time, I suppose, but when something like this happens, I wonder how they'll take responsibility.
Show original Japanese
チケットぴあとか、ヨドバシドットコムとか、アマゾンとかもだけど、クレジットカード情報の登録が必須になってます。別に購入のたびに毎回入力して、決済が終わったら情報削除でもいいと思うのですが、サイト側は強制的に登録させます。そのほうが利用者側もササと決済できるし、そうすることでいつでも簡単に購入させられるからなんでしょうけど、こういうことがあったらどう責任を取ってくれるのか疑問です。My lady's reading
This is what my lady thought, looking at this comment section.
There's only so much an individual can do with password protection and the like.
Companies collect personal information they don't even need; services that could keep what they collect in a closed environment, but don't; and services that can't should spend money on security.
Every last one of these is a measure that earns the company nothing, so the people at the top won't approve it.
And in the first place, IT engineers, swamped by their everyday work, have no time to get round to the company's own internal troubles.
So who does it? General affairs, of course. But general affairs staff are even being called unnecessary now that IT has taken over, and a seriously large number of them - practically most of them - have no IT knowledge. Nobody knows what's what, the top doesn't know what to do either, and all they say is "sort it out somehow!" Talk about loose, loose, loose! I do hope they get their hands on the banks and brokerages soon! I do hope companies that manage personal information without being able to secure it get weeded out!
There must be plenty of them, mustn't there - sole tradesmen, funeral halls, hospitals and so on, places that don't manage things themselves. Ufufu.
That is my lady's reading.
Some of this can be counted. Did this thread fault companies for collecting too much? Did it talk about money, approvals and people? How did it see the banks and brokerages? First, though, what the story does not say.
The news
At 9:49pm on 26 October 2026, TBS NEWS DIG published a story on Yahoo! News.
Its subject: on the 26th, Rakuten Group announced that overseas hotel booking pages and other parts of its travel booking site, Rakuten Travel, had been accessed without authorisation, and that personal data on up to about 2.6 million people may have leaked.
According to the story, an anomaly was detected on the 10th of last month on some of the pages for booking hotels abroad, and the names, email addresses, phone numbers and so on of up to about 2.6 million users who had logged in may have leaked. For people who actually made bookings, the last four digits of their credit cards, expiry dates and the like may have leaked too, up to about 36,000 records. On the 20th of this month, possible unauthorised access was also detected on the multilingual booking site for foreign visitors, and up to about 860,000 email addresses and other details may have leaked. Full card numbers and passwords were not included, and no misuse or other damage has been confirmed so far, the company says.
Context for readers outside Japan
Yahoo! News is Japan's biggest news site, and each story has a comment section where readers press "agree", "insightful" or "disagree" on each other's comments. Rakuten is one of Japan's largest internet groups: an online shopping mall, a travel booking site, a credit card, a bank, a brokerage and a mobile network, many of them used through one Rakuten ID. In Japanese companies, sōmu - general affairs - is the department that handles whatever no one else does, from office supplies to, often, the computers. And a ringi is the sign-off round in which a proposal - a budget, say - circulates for each manager's seal before anything is spent.
What the story does not say
I read the notice Rakuten Travel put out on the same day, 26 October.
The targets were some pages of the overseas hotel booking site managed and run by Rakuten Travel Xchange, a Rakuten Group subsidiary, and the multilingual booking site managed and run by Rakuten Group itself.
For the overseas hotel pages, the notice says an anomaly was detected on 9 September, the cause was identified on 15 September, and the system fix was completed on 16 September. Why the announcement came on 26 October, the notice does not say.
The data that may have leaked falls into two groups. For up to about 40,000 people who made bookings: name, email address, phone number, country of residence, booking details (property, price and so on), and the names and countries of residence of those travelling with them. For up to about 36,000 of those, the card issuer number and last four digits, the cardholder's name, the expiry date and the card brand. For up to about 2.6 million people who logged in: name, email address, phone number and an internal ID number. Full card numbers, security codes, passwords, passports or other identity documents, and addresses were not included, the notice says.
For the multilingual site, possible unauthorised access was detected on 20 October, the cause identified the same day, and the fix completed on the 21st. The data covered email addresses and internal ID numbers for up to about 860,000 people who logged in, and account names and other details for up to about 40,000 accommodation staff.
The notice also says that Rakuten's security team has found nothing similar outside these sites, and that the matter has been reported to Japan's Personal Information Protection Commission and to the relevant authorities abroad.
92 to 8: 790 comments, 10 hours in
I read all 790 parent comments, as they stood at 7:58am on 27 October, about 10 hours after publication. The site was showing 793 parent comments when I loaded the thread; 3 of them would not load. The article showed 1,009 comments in total at 7:56am.
The buttons came to 24,919 agree, 2,171 insightful and 2,299 disagree presses. Positive presses against disagree presses: 92 to 8.
The votes sit very heavily at the top. The first comment alone holds 38.7% of the agree presses, the top 3 61.1%, the top 5 71.8%. 307 of the 790 got no agree press at all.
Sorted by whom they blamed: the 253 comments (32.0%) blaming Rakuten or companies - how they collect, how they protect, how they announce - hold 64.6% of the agree presses. The 13 (1.6%) defending Rakuten, or saying it's overblown or unavoidable, hold 1.3%.
At the top: shops that make you register your card
(This is the most-agreed comment, shown at the top of this page.)
1st in the vote order: 9,638 agree, 595 insightful and 345 disagree presses, with 79 replies. This one comment holds 38.7% of all the agree presses in the thread.
The 2nd comment (3,199 agree) points the same way: why not scrap compulsory membership; if you're only buying, enter your name and address each time; trying to manage it all digitally in one place is what lets the unexpected happen.
The 36 comments (4.6%) saying companies collect too much personal data, or force people to register cards and accounts, hold 54.4% of the agree presses. The 12th (173 agree), asking why companies don't just throw away the data they hold, is counted here too. Without the top 2, though, it is 2.9%.
Banks and brokerages: worried over as the last line of defence
The 3rd comment (2,387 agree, 36 disagree) said it assumes almost all personal data connected to the internet has leaked already, and went on: the worry is the last line of defence, online banking.
The 54 comments worried about banks, brokerages or online banking hold 11.3% of the agree presses. 9.6% of that is the 3rd comment alone; without it, 1.8%. The 61 worried it would spread to Rakuten's own bank, brokerage, card or shopping mall hold 2.0%. The notice says nothing similar has been found outside the affected sites.
The 133 saying it has all leaked already, or nowhere is safe, hold 24.2%.
Six weeks to the announcement
The 52 comments saying the gap from detection to announcement was too long hold 6.7% of the agree presses. The 5th (818 agree) asked for a proper account of what happened between detecting the anomaly and announcing it. Of the 52, the 21 saying Rakuten slipped the news out among other companies' announcements, or had been hiding it, hold 0.9%. The notice says the fix was finished on 16 September, but not why the announcement came on 26 October.
The 32 doubting "no damage has been confirmed" hold 5.0%. The 11th - that only means within whatever you've checked - got 178 agree and 2 disagree presses.
The 13 defending Rakuten, or saying it's overblown or unavoidable, hold 1.3% of the agree presses but 12.8% of the disagree presses. The most-voted of them is the 9th (216 agree, 217 disagree): the headline says "up to 2.6 million", but the card details number about 36,000, and rather than stirring up fear it is more realistic to check the individual notices and watch for suspicious emails and calls. Even this comment asked why the announcement was delayed.
Checking my lady's reading
My lady said: there's only so much an individual can do with password protection and the like.
The 24 comments saying there's only so much an individual can do hold 0.8% of the agree presses. The 18th (122 agree) said that people are told to change passwords often, but an old person like the writer can't manage it. The 90th (11 agree): with leaks this frequent, it is beyond what self-defence can handle. Meanwhile the 83 describing steps they take themselves - changing passwords, deleting saved cards, paying cash, checking statements - hold 3.9%.
My lady also said: companies collect personal information they don't even need.
The 36 faulting over-collection or forced sign-ups hold 54.4%. The biggest voice in this thread said the same thing my lady did.
My lady also said: services that could keep what they collect in a closed environment, but don't.
The 9 saying plainly to keep the data off the network got 19 agree presses between them: 0.1%. The 89th (11 agree) said that if personal data isn't stored while connected to the internet, it can't leak even if someone breaks in. The comment my lady shared is one of those 9.
In the late 1990s, when I was posted abroad, an engineer in Silicon Valley told me: "They will absolutely get in, even over a network. That's why I handle my important information on a PC with no network." Back then in America, even when buying online, you could choose to give just your credit card details over the phone. I'd been watching the recent security-leak reports with distaste - and now Rakuten Travel. Since retiring I've kept booking my stays the way my old company had us do it, only ever through Rakuten Travel. Last week I booked next month's Kansai trip here too. So it's finally come straight to my door. What a nuisance.
1990年代後半、駐在中にシリコンバレーの技術者に、「絶対にネットワーク越しでも、侵入させる。だから、自分の大事な情報は、ネットワーク無しPCで扱っている。」と言われた。当時のアメリカでは、ネット販売でもクレジットカード情報だけは電話で伝える、という販売が選べた。
最近の、セキュリティ漏れ報道を苦々しく見ていたが、楽天トラベルかぁ～。定年後の宿泊予約は、以前の会社指定のまま、楽天トラベルしか使っていないのですよ。先週、来月の関西旅行もここ。
ついに自分のところに直接、来ましたね。困ったものです。No agree presses yet: 3 insightful and 0 disagree. In the site's recommended order, it sat 100th.
My lady also said: services that can't should spend money on security, and every last one of these earns the company nothing, so the top won't approve it.
The 19 comments touching on why the data isn't protected - security costs money, money is spared, sales come first, budgets or ringi don't get through, there aren't enough people, the top doesn't understand IT - hold 0.9% of the agree presses. One used the word ringi.
So security's full of holes everywhere, huh. At my company too, the ringi for security spending never gets approved, because "security costs money". I guess Japanese companies really are all like this.
どこもかしこもセキュリティガバガバなんだなぁ
うちの会社もセキュリティに金がかかるといってセキュリティ対策費の稟議が下りないし
日本企業ってやはりどこもこんな感じなのかな102nd in the vote order, 9 agree presses.
My lady also said: IT engineers, swamped by their everyday work, have no time for the company's own internal troubles.
The 4 comments mentioning staffing hold 0.4%. The closest to my lady's point was the 484th, with no agree presses at all: even big companies find problems at every yearly vulnerability check and can't fix them before the next one, so they pile up; staff engineers are cut in the name of in-house tools and automation, and the front line gets by with the tools it already has; what's needed is the people, the budget and an accountable setup to fix flagged problems on time.
My lady also said: so who does it? General affairs, of course.
No comment mentioned the general affairs department. The only appearance of the word sōmu was in one comment about the Ministry of Internal Affairs and Communications, whose Japanese name contains it. Closest to "the top doesn't know what to do either" was the 25th (82 agree): many bosses understand nothing about IT, and only a few staff do. That is the only comment saying the people at the top don't understand IT, at 0.3%.
My lady also said: I do hope they get their hands on the banks and brokerages soon.
That is exactly what this thread feared most. The 54 comments worried about banks, brokerages or online banking hold 11.3%, and the 3rd called the bank the last line of defence. One comment wished other companies' data would leak too; it got no agree presses.
My lady also said: companies that can't secure personal information should be weeded out.
The 6 comments saying such firms should be weeded out, go under, or have no choice but to close hold 0.5% of the agree presses. Widened to the calls for penalties, damages or a payment, it is 62 comments and 1.6%.
My lady also said: there must be plenty of them - sole tradesmen, funeral halls, hospitals and so on, places that don't manage things themselves.
No comment mentioned hospitals, funeral halls or tradesmen. 2 mentioned smaller companies; the 23rd (98 agree) said small firms that can't afford huge sums on defence will have no choice but to close. According to the notice, the pages that were hit were managed and run by a Rakuten subsidiary. The 3 comments saying the work was handed to outsiders, or that partners or suppliers were the way in, got 2 agree presses between them.
What I have not checked
This is the thread about 10 hours after publication. Comments added later are not in these counts.
I have read Rakuten Travel's notice, but I have not checked when it reported to the Personal Information Protection Commission, or what the rules say about how many days may pass between detection and reporting. Why the announcement came on 26 October is not known to me either.
Who the attackers were, and from which country, is in neither the story nor the notice. The 26 comments naming or guessing at a country hold 0.4% of the agree presses; I have not checked any of it. Nor have I checked whether the other shops named in the top comment really make card registration compulsory.
Which comment goes where was decided by reading each one, not by searching for words. Treat the counts as approximate.
The 33 comments (4.2%) that lumped people together by country or nationality, made unverifiable insinuations, or contained abuse hold 0.3% of the agree presses. They are counted, but I have not quoted them.
In closing
My lady said: companies collect personal information they don't even need.
The 36 comments faulting over-collection or forced sign-ups drew 54.4% of the agree presses in this thread. Its biggest voice was looking at the same thing my lady was.
But why the data isn't protected - money, approvals, staff - came up in 19 comments, with 0.9%. One used the word ringi; none mentioned the general affairs department. And the banks and brokerages were worried over as the last line of defence.
That is as far as the counting goes.
The top five comments by vote
Ranked by upvotes. Left of the slash is agree, right is disagree. This is where the resentment actually sits.
- 1st 9638 ∕ 345 Big ticketing, electronics and shopping sites make registering a credit card compulsory too. You could just as well type it in each time and have it deleted after payment, but the sites force you to register. Quicker checkout, easier to get you buying any time, presumably - but when something like this happens, how will they take responsibility?
- 2nd 3199 ∕ 203 Why not scrap compulsory membership on these sites? If you're only buying, enter your name and address each time. Send the record of the transaction on paper with the goods. Trying to manage everything digitally in one place is what lets the unexpected happen. At least manage customers' information one person at a time
- 3rd 2387 ∕ 36 I assume almost all personal data connected to the internet has leaked already. The question is what real damage follows. If a card is used without permission, will anyone cover it? The worry is the last line of defence, online banking. If balances can be altered, money is as good as worthless
- 4th 1850 ∕ 71 Someone who left an AI company talked about heading for ruin - did that mean breaking into infrastructure until the country fails? If this goes on, trust disappears and things stop working. With wars and cyber attacks, the world seems to be heading in a bad direction
- 5th 818 ∕ 65 Up to 2.6 million records may have leaked; 'no misuse has been confirmed' does not settle it. Why was the break-in allowed? Explain the cause, the measures to stop it happening again, and what happened between detecting the problem and announcing it. 'Not confirmed' does not mean 'not happened'
Every number from this thread
I read all 790 parent comments, as they stood at 7:58am on 27 October 2026, about 10 hours after publication. The site was showing 793 parent comments when I loaded the thread; 3 of them would not load. The article showed 1,009 comments in total at 7:56am, and the parent comments had 221 replies. The buttons came to 24,919 agree, 2,171 insightful and 2,299 disagree - 92 to 8. Agree against disagree alone is also 92 to 8. The votes sit very heavily at the top: the first comment alone holds 38.7% of the agree presses, the top 3 61.1%, the top 5 71.8%, the top 10 79.5% and the top 20 85.4%. 307 of the 790 got no agree press at all, 221 got no press of any kind, and the 62 where disagree outnumbered agree hold 36.4% of all disagree presses in the thread. The average comment is 74.7 characters long, and the 314 under 40 characters hold 3.1% of the agree presses. Of the 221 replies, 79 are on the top comment. I counted whom each comment blamed. The 253 comments (32.0%) blaming Rakuten or companies - how they collect, how they protect, how they announce - hold 64.6% of the agree presses and 46.5% of the insightful presses. The 13 (1.6%) defending Rakuten, or saying it's overblown or unavoidable, hold 1.3% of the agree presses and 12.8% of the disagree presses. The 524 that blamed neither hold 34.1%. I also counted what the comments said. The 36 saying companies collect too much personal data, or force people to register cards and accounts, hold 54.4% of the agree presses; 38.7% of that is the first comment alone, and without the top 2 it is 2.9%. The 133 saying it has all leaked already, or nowhere is safe, hold 24.2%. The 54 worried about banks, brokerages or online banking hold 11.3%, of which 9.6% is the 3rd comment alone. The 54 mentioning AI hold 9.6%, and the 85 mentioning the state, the government or attacks from abroad 8.6%. The 52 saying the gap from detection to announcement was too long hold 6.7%; of those, the 21 saying Rakuten slipped the news out among other companies' announcements, or had been hiding it, hold 0.9%. The 32 doubting 'no damage has been confirmed' hold 5.0%, the 83 describing steps they take themselves 3.9%, the 61 worried it would spread to other Rakuten services 2.0%, and the 62 calling for penalties, damages or a payment 1.6%. Now, the results for my lady's reading. My lady said there's only so much an individual can do with password protection. The 24 saying there's only so much an individual can do hold 0.8%; the 83 describing steps they take themselves, 3.9%. My lady said companies collect personal information they don't need. The 36 faulting over-collection or forced sign-ups hold 54.4%. My lady said what is collected could be kept in a closed environment. The 9 saying plainly to keep the data off the network got 19 agree presses between them, 0.1%. My lady said it comes down to spending money on security, which the top won't approve because it earns nothing. The 19 touching on money for security, approvals, staffing or whether the top understands IT hold 0.9%. One used the word ringi, with 9 agree presses. My lady said IT engineers have no time. The 4 mentioning staffing hold 0.4%. My lady spoke of the general affairs department. None mentioned it, and 1 comment, holding 0.3%, said the people at the top don't understand IT. My lady said: may they get their hands on the banks and brokerages soon. The 54 worried about banks or brokerages hold 11.3%, and 1 comment wished other companies' data would leak too, with no agree presses. My lady said companies that can't protect data should be weeded out. The 6 saying such firms should be weeded out or go under hold 0.5%; widened to the 62 calling for penalties or damages, 1.6%. My lady spoke of sole tradesmen, funeral halls and hospitals. None mentioned hospitals, funeral halls or tradesmen, and 2 mentioned smaller companies. Which comment goes where was decided by reading all 790 one by one, so treat the counts as approximate. The 33 comments (4.2%) that lumped people together by country or nationality, made unverifiable insinuations, or contained abuse hold 0.3% of the agree presses. I have not quoted them. The comment my lady shared had no agree presses yet: 3 insightful and 0 disagree presses, with no replies.
Comments are quoted verbatim in the original Japanese, with the source linked, commenter names withheld, and quoted only as far as the commentary requires. Translations are mine. Source articles may expire (retrieval dates noted). The substance of this piece is the author's commentary.
