Taiwanese online travel agency ezTravel has confirmed a data breach affecting more than 690,000 members, after unusual activity was detected on its membership system last week. The company says no credit card numbers were compromised, but it has warned customers to stay alert for scam messages pretending to come from its staff or from banks.

ezTravel said it detected unusual external network activity targeting its membership system on Friday, 7 November, and moved immediately to block the suspicious traffic. The company announced the breach on Monday, 9 November, and said it had hired an independent cybersecurity team to investigate and carry out a digital forensic analysis.

What was exposed

Based on its preliminary investigation, ezTravel said information from some past bookings had been improperly accessed. The data potentially exposed includes members' names, email addresses, phone numbers and purchase details.

The company stressed that the breach did not involve credit card numbers, security codes, account passwords, passport numbers or national identification numbers, and that the security of customers' payments had not been affected.

Police and regulators told

ezTravel said it has reported the incident to the appropriate government agencies and police in accordance with Taiwan's personal data protection laws. It apologised for causing concern among consumers and pledged to safeguard customers' personal information.

The company said it has notified affected customers by text message and email. It warned that scammers might impersonate customer service staff or bank representatives to obtain credit card details or verification codes, or trick customers into using ATMs or clicking suspicious links.

What customers should do

ezTravel stressed that it would never ask customers to disclose account passwords or verification codes, or use ATMs to cancel instalment payments. Anyone contacted in that way should treat the message as a scam and check directly with the company or their bank through official channels.

The incident is the latest in a run of breaches hitting travel and membership systems in Asia. The investigation into how the attackers reached ezTravel's membership system is continuing, and the company said it would update customers as its forensic work progresses.

Taiwan has seen a string of member-data incidents in recent weeks. Japanese retailer MUJI said in late October that up to about 27.26 million member records tied to its official app may have been accessed, while restaurant chain Matsuya reported about 2.38 million ordering-service customer records affected. Taiwan's Administration for Cyber Security has urged businesses to reduce their attack surface and keep backup and recovery plans ready, a reminder that the weak point is often a third-party service or a single exposed system rather than a company's main servers.