Myrealtrip, a South Korean travel platform offering flights, accommodation, tours and activities, confirmed on 25 October 2026 that an unauthorised outsider gained abnormal access to its systems and leaked user information, including names, email addresses and, for some users, passport numbers and passport expiration dates. The company stated that payment information was not affected, and it has not disclosed how many users were affected. The incident is a confirmed company disclosure reported by established Korean outlets, rather than an attacker claim, and the reporting to date leaves the attack method, the intrusion window and the victim count unstated.
Disclosure timeline
A notice and apology appeared on the Myrealtrip website on 28 October 2026, according to the Seoul Economic Daily caption of the website notice, and reporting of the company statement followed on 29 October, according to Seoul Economic Daily. The company statement described the confirmation on 25 October as the point at which abnormal access by an unauthorised outsider and a leak of user information were established. The same statement recorded that the company was investigating how and why the incident occurred, and a company official said Myrealtrip would cooperate fully with the investigation by relevant authorities and take steps to prevent a recurrence. The reporting does not name the relevant authorities, and it does not state when the access began, so the confirmation date remains the only dated point in the intrusion chronology. The reporting also does not confirm that the leaked data was published or sold externally, and no such publication or sale is claimed in this article.
Exposed data
The exposed items varied by user, and the passport items carried the narrowest qualifier in the company statement. According to JKN, the leaked information included names, email addresses, mobile phone numbers, dates of birth, gender and encrypted passwords, while passport numbers and passport expiration dates used for overseas travel reservations were included for some users only. Maeil Business Newspaper corroborated that list and reported that the leaked items may differ by user, with a self-check page on the Myrealtrip website showing each affected user which specific items were exposed for that account. The combination matters because a name, an email address, a phone number and a date of birth together give a scammer plausible material for a convincing message, and the company itself warned of identity theft, voice phishing and smishing arising from the leak. Passport numbers and expiration dates are long-lived identity details held by the platform because users supplied them for overseas travel reservations, and the reporting gives no breakdown of how many users had passport data exposed.
The passport items in this breach do not change the password advice in the company statement, and they do not make an email alias a protection for identity documents. An alias limits only which email address a platform holds and therefore which address a breach of that platform exposes. Passport numbers, phone numbers and dates of birth supplied to the platform remain exposed wherever the platform stored them.
Excluded data
The company statement excluded two categories from the leak, and that exclusion defines the boundary of the confirmed exposure. Credit card details were not included in the leak, and travel reservation and purchase history was also not included, according to the company statement as reported by JKN and Maeil Business Newspaper. The breach therefore exposed identity and contact details, not payment methods or trip records, on the facts currently disclosed. That boundary is subject to the same qualification as the rest of the disclosure: it rests on the company statement, and the investigation has not yet published a fuller account of the affected systems or of the data held in them.
Company measures
Myrealtrip stated that it blocked the abnormal access immediately after detecting the breach, inspected and reinforced the affected systems, and strengthened its detection and blocking systems to prevent further leaks. Continuous monitoring followed, with round-the-clock real-time monitoring reported as part of the response, according to JKN, and the company reported the breach to relevant authorities under personal information protection laws. The company also said it would provide further details through follow-up notices, and that it would cooperate with the ongoing investigation.
Affected users can check whether they were affected and which specific items were exposed by logging in to a dedicated page on the Myrealtrip website, according to the company. The reporting also records procedures such as claiming damages or applying for personal-information dispute settlement as options available to affected users, according to Maeil Business Newspaper, and the company apology accompanied the website notice described in the disclosure chronology above.
Measures for affected users
The company statements reported so far give warnings and requests rather than a published remediation programme. Myrealtrip urged users to change their passwords and to be cautious about text messages and emails from unidentified sources, in light of the stated risks of identity theft, voice phishing and smishing. The encrypted state of the exposed passwords does not remove the reason for the password advice, since reuse of the same password elsewhere would still leave other accounts exposed, and an address can be checked against other known breaches through the steps described in the AliasFleet guide on checking whether an email was leaked. The mechanism by which an exposed address becomes a targeted message is described in how phishing uses a leaked email, and the wider link between an exposed address and identity fraud is described in how email leads to identity theft. Whether changing a password alone closes the exposure depends on reuse elsewhere, a point covered in does changing your password stop hackers. No source in this reporting tells affected users to reissue their passports, and no such step is advised here. The travel-booking case for limiting the address a platform holds is covered in how to use email aliases for travel bookings, and the general mechanism of a separate address per service is described in what is an email alias.
A separate address per service limits what a platform breach exposes. AliasFleet provides a separate email alias for each service, and an alias can be paused or replaced without changing the main inbox address. That limit is narrow: an alias does not protect passport numbers or other identity documents supplied to a platform, since those details remain in the platform's own records wherever it stored them.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Outstanding facts
The investigation has not yet published the basic facts that would let affected users judge the scale of the breach, and the company promises further details in follow-up notices. No victim count has been disclosed, no attack method has been named, and no intrusion window beyond the 25 October confirmation has been stated. No confirmed external publication or sale of the data has been reported, and no passport-reissue guidance appears in the reporting. The count, the method and the intrusion window are therefore the items to watch for in the follow-up notices, and the status of the data outside Myrealtrip systems remains unconfirmed until a later company statement or a verified independent report addresses it. A further check against the public breach record, including Have I Been Pwned, would add an independent confirmation point if the incident is later listed there, but no such listing is claimed here.
Top comments (0)