# The guest got the message first

2026-10-10

Temairazu says up to 4.45 million hotel reservations may have been viewed. Hotels reported suspicious messages to guests on 21 September. The company does not hold card numbers. The front desk being open is not the file.

Canonical: https://www.fabiocti.com/notes/the-guest-got-the-message-first/
Author: Fabio Correia

The guests heard first. The ceiling arrived today.

Temairazu says accommodation-reservation data for up to about 4.45 million people may have been viewed or taken from its booking system. The fields it names are the guest’s name, phone, email and other contact details, the property, the check-in and check-out dates, and the room charges. It says it does not hold credit card numbers. On 21 September, hotels using the system told the company that reservation holders were getting suspicious messages. That is what started the look. The company then confirmed a third party had access, cut off further damage, and says the fixes for the cause it has identified so far are done. An outside firm is still checking scope. It has reported the matter to Japan’s Personal Information Protection Commission and talked to the police.

A stay that proceeds on Saturday is evidence about the hotel’s own desk. It is not evidence about a reservation row that left the switchboard in September. The message the guest already received is the incident. Today’s number is how wide the switchboard might have been.

## What “no card data” will be asked to cover

It covers the payment instrument Temairazu says it never stored. It does not cover a name, a phone, a travel date, and a hotel. That set is enough for a message that sounds like the property: a change of arrival, a deposit, a link. The hotels noticed that shape on 21 September. Anyone briefing “the booking site is normal this weekend” is describing the control they reasserted, not the copies already sent.

If you booked through a property on this system, treat a message that knows the dates and the hotel as the file, not as a marketing mail. Do not pay it and do not open it to “confirm the reservation.” The company has said it will keep investigating the true scope. Until that scope shrinks in a notice, the practical assumption is the contact fields and the itinerary, not the card.

The guest’s phone was three weeks ahead of the 4.45 million. Believe the phone.