Temairazu Breach May Have Exposed 4.45 Million Bookings

Temairazu's hotel reservation system may have leaked 4.45 million guest records. Disclosed 9 October. A booking record is the most weaponisable record a breach can produce: it tells the scammer where you will be, and when. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. And in this case, the lures were already landing before the disclosure did.

What Temairazu confirmed

The disclosure came on 9 October, covered in The Japan Times's travel-breach roundup. Two facts sit on opposite sides of the certainty line.

First, the phishing is confirmed. From late night on 21 September, guests started getting suspicious messages about their bookings on WhatsApp, WeChat, email and SMS. The messages quoted real reservation details, posed as hotel staff, and pushed people to re-enter card information or make urgent payments on fake sites (TRAICY, TokyoReporter). The company confirmed unauthorised access, said it could not rule out that guest data had been viewed or obtained, suspended parts of the system, then brought it back to normal operation.

Second, the scale is not confirmed. Up to about 4.45 million people may have had their data leaked, per the company's own announcement as reported. The at-risk fields are names, phone numbers and email addresses of bookers, plus the hotel name, check-in and check-out dates, and room rates. Credit card data was not among them; Temairazu says its system does not directly handle or store it. Whether any data was actually exfiltrated, how the attacker got in, and whether the final count moves are all still open.

One caution on the numbers: the 4.45 million figure and the field list rest on the company's announcement as reported in the press, and I could not pull up the announcement directly to check its exact wording. Treat the scope as the company's estimate until it says more. The phishing campaign is the part that needs no hedging. It was running for two to three weeks before the disclosure.

The lures arrived before the disclosure

Read the sequence, because it matters more than the number.

Late on 21 September: lodging facilities start reporting guests receiving messages that quote their actual bookings. The company confirms unauthorised access, says it cannot rule out that guest data was viewed or obtained, suspends parts of the system. Then, on 9 October: the scale figure.

That ordering is the story. The attackers did not steal the data and sit on it. By late night on 21 September the phishing kit was already landing in guests' inboxes, posing as the hotel using the real reservation details. By the time the number went public, the weaponisation was in its third week. Anyone who still thinks of a breach as "data sits somewhere until someone notices" should update that mental model. The phishing wave is the exfiltration announcement.

The lure design is worth a closer look, too. It never asks you to trust a stranger. It arrives wearing your own itinerary: your name, your hotel, your dates, a link to "confirm" or "finalise" the booking. And a booking carries its own deadline. A message saying your room needs re-confirmation before check-in on Friday hits differently from a generic "there is an issue with your account" email. The check-in date is the time pressure, and time pressure is what makes people skip the one verification step they would otherwise take.

What to do if you booked through a TEMAIRAZU hotel

1. Treat every message about your booking as guilty until proven innocent. The scammers quote real reservation details, so "it knew my dates" proves nothing. Contact the hotel directly, through its own site or a number you look up yourself.
2. Click nothing in any message about the booking. No links, no attachments, on any channel: email, SMS, WhatsApp, WeChat. The fake sites asked for card re-entry and urgent payments. If you already typed card details into one, call your card provider now.
3. Change the password anywhere you reused the one attached to the booking account. Card numbers were not in the exposed fields, but credential stuffing pairs leaked emails with passwords taken from other breaches.
4. Watch for follow-up lures timed to your travel dates. A "check-in reminder" or "itinerary change" landing a few days before your stay is exactly this attack's shape.
5. Check Have I Been Pwned once the incident is listed, and work through the breach-response order of operations.

A message about your hotel stay that quotes your real name, hotel and dates is exactly what the confirmed phishing wave looks like. Do not click. Do not enter card details. Look up the hotel's own contact yourself and ask whether anything actually needs confirming.

Give every booking its own address

Here is the one field in this leak you could have made useless to the attacker: the email address you handed the booking site. A unique email alias per booking, forwarding to your real inbox, turns the impersonation test from impossible to trivial.

The mechanism is simple. The alias given to the booking is the only address that booking's channel ever saw. Every legitimate message about the stay arrives on that alias, and there is no second channel. A "booking confirmation" or "urgent itinerary change" arriving at your real address, or on any other alias, has outed itself as the forgery before you read a word. And if the booking platform leaks, the leak-tracing mechanism tells you exactly which company it escaped from. Kill the alias after the trip and the whole channel dies with it. The set-up guide takes about two minutes.

Bookings are the address nobody thinks to protect. You type your real email to hold a room for one weekend, and that record sits in a reservation system for years, next to your name, your phone number and your travel dates. The same week brought Lawson's confirmation of a 2.15 million-member breach and Daiichi Kosho's disclosure of 8.72 million karaoke member records: the casual signup is the breach vector of the season, and the booking is its most weaponisable form.

What to watch in the Temairazu investigation

Three things. First, whether "may have leaked" becomes confirmed exfiltration, and whether the 4.45 million figure moves. Second, whether the phishing campaign scales further now that the scope is public, especially lures timed to upcoming check-in dates. Third, whether the investigation names the attack vector. A reservation-management system sitting between lodging facilities and millions of guests is infrastructure, and infrastructure breaches repeat. The investigation continues. So does the phishing.