skyticket-bus-2026 · Disclosed 2026-10-09
skyticket bus: automated access to reservation pages without login
Reservation pages accessible without login were mechanically viewed on August 3–October 1. About 12,000 reservations are affected; the number of people is higher when companions are included.
Outcome: Confirmed breach
Entry path and evidence
- Reported fact
Reservation completion pages were accessible without login and mechanically viewed by a third party; this was more than an unexploited exposure.
[s1]§1(3) - Reported fact
Reservation and companion data for about 12,000 bookings were viewed or may have been viewed. The figure is not a person count.
[s1]§1(3)
Timeline
Reported response
- Reported fact
The unauthenticated-access condition was fixed on October 1.
[s1]§1(3)
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Operational controls to inspect
Inspect authentication, per-user authorization and logs of automated access to booking pages. The notice does not disclose implementation code.
Editorial assessment; not a determination of liability. [s1]
Unknowns and AI involvement
The reviewed disclosures do not establish attacker use of AI.
Deduplicated counts of travelers are undisclosed. Specific code and pre-fix assessment coverage are not established.
Sources
[s1] アドベンチャー · Primary source
不正アクセスによるお客様情報の流出に関するお詫びとお知らせ ↗Published 2026-10-09 · Reviewed 2026-10-19