The refund account sat in the copy

The member book already left. The copy still had the refund account.

Adventure, which runs Skyticket, said today that the access of 2–4 October, already used on the live member file, was then used on a database copy it had left in the cloud after it no longer needed it. The bank part of that copy was sent out: 32,341 refund accounts registered between 1 March 2022 and May 2024. Bank name, account type, number, kana name. Kanji name, address, email, phone, PIN and banking login, it says, are not in those 32,341. The account name field was stored unencrypted. It should not have been.

Cards: about 936,000 rows, about 414,000 people, payments from about May 2021 to mid-May 2024. Name on card, a masked number — last four, or BIN plus last four — and browser data. Full PAN, expiry and CVV, it says, are not in that set, except twelve rows where someone typed the PAN into the name field. Those twelve have been handed to the acquirer. Travel insurance applications: about 118,000 rows, about 119,000 people. Kana name, date of birth, gender, mobile, email, member ID, the flight. Names there were also stored unencrypted.

The first file, 9 October: about 14.64 million member rows. 16 October: up to 6,140 cards. This is the leftover copy. They cannot match the bank and card rooms back to a contact, so the website is the letter. The copy is being held for forensics and then deleted. The stolen login that opened it has been killed.

What 32,341 will be asked to cover

It will be briefed as every Skyticket card since 2021. 32,341 accounts left. 936,000 card rows may have. Twelve PANs sat in a name field. It will be briefed as 14.64 million bank accounts. That number is the member book from the 9th. Do not add them.

If you registered a refund account in that window, the number is the incident. If you only paid by card, you are in the “may have” room until they subtract, except the twelve. A call that already knows the refund bank and asks for the PIN is not their letter. They will not ask for one.

Thirty-two thousand is a refund book that sat in a copy. The member file was already gone.