South Korean travel platform Myrealtrip has confirmed a data breach in which personal information, including some users' passport numbers, was exposed. The company said on 29 October 2026 that it confirmed on 25 October that an unauthorised outsider had gained abnormal access to its systems and leaked user information.

Access blocked and authorities notified

The exposed data included names, email addresses, mobile phone numbers, dates of birth, gender and encrypted passwords. Passport numbers and passport expiry dates of some users were also included, according to the company's notice. Payment information such as credit card details, along with booking and purchase records, was not affected, the company said.

Why passport data raises the risk

Myrealtrip said it blocked the abnormal access immediately after detecting the breach and inspected and reinforced the affected systems. It strengthened its detection and blocking systems to prevent further leaks and began continuous monitoring. The company reported the breach to the relevant authorities and said it is investigating how and why the incident occurred.

Users were advised to check the company's website to see whether their data was exposed and which items were affected. Because the leaked information could be used for identity theft, voice phishing or smishing, the company urged users to change their passwords and be cautious of text messages and emails from unidentified sources.

Passport numbers do not change as easily as a password, so their exposure carries a longer-lasting risk. Affected users should be wary of messages quoting real personal details to appear legitimate, and should contact Myrealtrip through its official website rather than through links in unsolicited messages.

Sources: Seoul Economic Daily and JKN News, both reporting Myrealtrip's notice.