This week in email privacy had one headline number: 14.64 million records exposed in the Skyticket breach. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. Seven stories mattered this week, and they prove the same point from opposite ends. Your real address keeps ending up in other people's files. The phishing keeps getting better at wearing it.
Skyticket: three intrusions, 14.64 million records
Adventure, which runs the Japanese booking site skyticket, disclosed on 9 October that intruders reached customer data three separate ways. A server intrusion on 2-4 October touched about 14.64 million records, including 4.13 million hashed login passwords. A management system intrusion on 20 September exposed 17,780 records, including refund bank account details. And a bus booking flaw left roughly 12,000 reservations viewable without logging in for nearly two months.
Names, emails, phone numbers, addresses, travel plans. No credit card numbers or passport images were stored, which is the one bright spot in the filing. For your inbox this is the ugliest breach shape of all: the victim notification comes by email, which is precisely the format the forgeries will copy. Read the full breakdown.
Temairazu: 4.45 million bookings, and the phishing is already real
On 9 October, Temairazu said up to about 4.45 million guest records may have leaked from its hotel reservation system: names, phone numbers, email addresses, plus hotel names, check-in and check-out dates, room rates. The scale is still unconfirmed. The phishing is not.
Since late night on 21 September, guests have been getting messages through WhatsApp, WeChat, email and SMS that quote real reservation details and push fake card re-entry or urgent payment pages. A booking record tells a scammer where you will be and when. That is a far harder lure to ignore than generic spam. Read the full breakdown.
dip and Baitoru: 3.88 million emails, nothing else
On 9 October, dip said the Baitoru and Baitoru NEXT job sites may have leaked up to 3,885,771 member email addresses, after unauthorised overseas access on 6 October exploited a specification flaw. No names. No passwords. No payment data. Just emails.
That is still a complete phishing kit. Every address on that list belongs to a registered job seeker, and dip itself warned users to expect suspicious mail. Expect fake job offers and forged dip notifications. Read the full breakdown.
Commune: one stolen file, new brand slices all week
Commune disclosed on 9 October that about 307,000 member records across Commune and Commune for Work were exposed, roughly 126,000 of them carrying email addresses. Then the week filled in the names: Suzuki Village with about 3,000 car-owner records, ZENB GARDEN with 897 leaked emails, LINE Yahoo's DS.LAB with 1,750, Sansan with 1,325, Panasonic with about 5,000 across two communities, Bandai Namco Experience with about 1,700, and a Kochi tourism site with 358.
The total is not growing. Only the shape is coming into focus. And the method, stolen invite links plus admin impersonation from inside the communities, is the part worth remembering: the vendor you never chose holds your data too. Read the original disclosure, the first follow-up, and the second.
ASOS: it started with one impersonated contact
Two days after its "ASOS HACKED" push alert, ASOS said how it happened. An attacker impersonated a trusted contact, took an employee's login, and used it to get into third-party platforms ASOS uses. Names and contact details may have been accessed. No payment card data, no account passwords.
ASOS's own advisory is now your test for every message: the company says it will never ask for passwords, security codes or payment details through an unsolicited message or call, so any message that does is not from ASOS. The weeks after a breach like this are when the impersonation wave lands, quoting the company's own advisory text back at you. Read the full breakdown.
Barracuda: phishing emails now carry two payloads
Research from Barracuda, reported on 7 October by Infosecurity Magazine, found phishing emails with two targets in one message: a lure for the human, and hidden instructions for their AI inbox assistant. The hiding spots are HTML comments, invisible CSS text, Base64 blobs and zero-width characters. The mail client skips them. The AI reads them.
The injected instructions can make the assistant vouch for the message as legitimate or urgent. Barracuda found they can also push fake vendor payment changes and wire transfers. Prompt injection is now a named attack class, OWASP LLM01 (genai.owasp.org). Do not act on urgency that comes only from an AI summary. Open the raw email, and verify through a separate channel. Read the full breakdown.
Sign in with Google is a single point of failure
This week's TAKE-lane opinion made the case against chaining every login to Google. One banned, hacked or locked Google account, and the whole chain becomes one point of failure. Gmail is the recovery address of record for dozens of other accounts.
The fix: direct logins per service, each on its own unique email alias, with separate credentials or passkeys. Add the standalone password before disconnecting Google, never after. The viral version overstates the instant cascade. The duller truth is weeks of support tickets, unwinding one account at a time. Read the full piece.
The thread running through all of it
Every story this week ends at the same address. The email you gave one company is now in someone else's file, and the forged notifications will look exactly like the real ones. The one field you could have made traceable is the address itself: a unique email alias per site means every message on it is from that company or from the attacker, and the alias names its source the moment a leak or a forgery shows up.
If your address was in any of this week's files, check it at Have I Been Pwned once the incidents are listed, change any reused passwords now, and do not click a single link in any breach-related message this week. The Japan Times' roundup of the wave puts Skyticket's 14.64 million at the top of the list. Fourteen million records is a headline. The phishing wearing it is the part that lands in your inbox.
Top comments (0)