MyRealTrip suffers user personal data breach from external hacking

2026.10.30. The Fair Economy — An unauthorized external party accessed the travel platform MyRealTrip's system abnormally, resulting in the leakage of eight types of personal information including users' names, email addresses, mobile phone numbers, and dates of birth. Some users' data also included passport numbers and passport expiration dates, while credit card and other payment method information, reservation records, and purchase histories were not among the leaked items.

MyRealTrip posted a notice on its website on the 28th confirming that an unauthorized external party accessed the system abnormally and that user personal data had been leaked.

The company posted the notice under the title "Notice of Personal Information Leak and Apology." It is understood that the company became aware of the incident on the 25th, the day of the attack, and reported it to the relevant authorities the following day, the 26th.

The leaked items included gender, encrypted passwords and passport expiration dates. The specific items leaked may vary by user, and passport numbers and expiration dates were leaked only for some users. Passwords were stored using an irreversible encryption method. The exact number of affected users, the cause of the incident and the intrusion route were not specified in the notice. Users can check whether their information was leaked and which items were exposed on the "Check Personal Information Leak" page on the website.

The company said it blocked the abnormal access immediately after confirming the leak and inspected and reinforced the relevant systems. It also said it has strengthened its detection and blocking systems and is continuously monitoring them. The company apologized to customers, saying it takes the incident seriously.

MyRealTrip said it has reported the incident to the relevant authorities in accordance with applicable laws and is faithfully cooperating with the ongoing investigation. Noting that the leaked information could be misused for identity theft, voice phishing and smishing, the company urged users not to click links in messages or emails from unknown sources and to change their passwords. It said it will provide further updates as additional information is confirmed.

Affected users can seek remedies through procedures such as filing damage claims or applying for personal information dispute mediation.