# Two point six was a login count

2026-10-26

Rakuten Travel says up to about 2.6 million logged-in users on an overseas hotel site may have lost name, email, phone and an internal ID. Up to about 36,000 of the bookings also have card last-four. The multilingual site is a second file. Full PAN and CVV are not in it.

Canonical: https://www.fabiocti.com/notes/two-point-six-was-a-login-count/
Author: Fabio Correia

Two sites. One login ceiling. A last-four file next to it.

Rakuten Group said today that a third party reached part of the overseas hotel pages run by its Singapore subsidiary, Rakuten Travel Xchange, and a separate multilingual booking site it runs itself. Overseas hotel logins: up to about 2.6 million name, email, phone, internal ID. Bookings from those pages: up to about 40,000 — name, email, phone, country of residence, internal ID, hotel and amount, companion name and country. Of those, up to about 36,000 also have issuer BIN, last four, name on card, expiry, brand. Full PAN, CVV, password, passport and address are out.

They saw something on the hotel pages on 10 September, named the cause on the 15th, patched on the 16th, and later found the access in the look-back. The multilingual site: 20 October detect, same-day cause, 21 October patch. Up to about 860,000 logged-in emails and internal IDs, plus up to about 40,000 hotel-staff account names and emails from the admin screen. Korea, Taiwan, Hong Kong, Singapore, Macao and some US regions are carved out of the hotel pages. The two sites do not add.

They say the payment fields alone do not clear a charge. They have told Japan’s commission and foreign authorities. Other Rakuten properties, they say, are not in this path.

## What 2.6 million will be asked to cover

It will be briefed as every Rakuten Travel booking on earth, and as cards. It is a login list on one overseas hotel surface, plus 36,000 last-fours, plus a second site that is mostly emails. Do not add 2.6 to 0.86. Do not brief 40,000 staff as guests.

If you logged into those overseas pages, the name and the mail are the incident. If you paid there, last four and BIN are the next sentence. A reset that already knows Tuesday’s hotel is the next page if it is. Full-number plus CVV is not this file.

Two point six is a login count. Keep the last-four in a different sentence.