HIS says up to 627 customers' passport data may have leaked after Thai unit breach
In short
HIS announced on October 7 that up to 627 customers' passport details may have leaked after unauthorized access to a file server at its Thai subsidiary, H.I.S. TOURS. The company said it detected the access in December 2025 and identified the scope of passport data in February 2026, but did not disclose the matter until now, citing the volume and mixed formats of data on the server. No misuse of the leaked information has been confirmed, HIS said.
Read the full story 2 min read
HIS announced on October 7 that up to 627 people's passport information may have leaked after a third party gained unauthorized access to a file server at its Thai subsidiary, H.I.S. TOURS CO., LTD. The company said the compromise was detected in December 2025 and that data may have been improperly extracted from the server. [ 2 , 3 , 4 , 5 , 6 , 7 , 8 , 9 , 10 , 11 ]
According to HIS, the data that may have leaked includes alphabetized names, names in the passport signature field, gender, dates of birth, passport numbers, expiry dates and allergy information. Asahi Shimbun reported that some passport images also leaked in part, citing HIS, which did not disclose how many images were involved. HIS said phone numbers, addresses, email addresses and credit card information were not included. [ 2 , 5 , 8 , 9 , 10 ]
The affected customers are those who departed from Japan for Thailand on HIS tours in 2017, 2019-20 and 2024-25, the company said. HIS said it had confirmed no misuse of the leaked information as of October 7. [ 2 , 5 , 8 , 9 , 10 , 11 ]
ITmedia reported the sequence of the investigation: a detection tool on the file server raised an alert on December 11, 2025, prompting the server to be cut off from the network; on December 29, 2025, HIS confirmed the server held some personal information obtained in Japan; and on February 24, 2026, external experts determined that passport data for up to 627 people was present, after which HIS decided to review every file on the server. HIS attributed the length of the investigation to large volumes of accounting records and other data unrelated to personal information, stored in a variety of formats, which had to be checked manually. [ 2 ]
Nishi-Nippon Shimbun and Nippon TV News reported that HIS was aware of the possible leak in late February 2026 but did not announce it for about seven and a half months, and cited the company's explanation that verifying and cross-checking the mixed data took time. ITmedia and other outlets dated the unauthorized access to December 2025, while ITmedia also described the server as having been accessed without authorization in November 2025. The technical cause of the breach was not stated in the documents. [ 2 , 5 , 9 ]
HIS said it will contact customers whose details it can trace individually and published the matter on its own website to reach those whose contact information is hard to identify. The company said it will take appropriate measures if the personal information is misused. [ 2 ]
Why it matters
The incident affects customers who booked HIS tours to Thailand over several separate years, and the roughly seven-and-a-half-month gap between HIS learning of the possible leak and announcing it is likely to draw scrutiny of how travel firms handle customer passport data. Passport numbers, names and dates of birth are the kind of identity data that can be used for impersonation or fraud, though HIS says no misuse has been confirmed.
Key facts
- HIS said on October 7 that up to 627 people's passport information may have leaked after unauthorized access to a file server at its Thai subsidiary H.I.S. TOURS. [ 2 , 3 , 5 , 6 , 8 , 9 , 10 ]
- The data may include alphabetized names, names in the signature field, gender, dates of birth, passport numbers, expiry dates and allergy information. [ 2 , 5 , 8 , 10 ]
- HIS said phone numbers, addresses, email addresses and credit card information were not included. [ 2 , 9 ]
- Those affected are customers who departed from Japan for Thailand using HIS in 2017, 2019-20 and 2024-25. [ 2 , 5 , 8 , 9 , 10 ]
- HIS said it detected the unauthorized access in December 2025, confirmed that personal information was on the server on December 29, 2025, and determined on February 24, 2026 that up to 627 people's passport data was involved. [ 2 ]
- HIS said no misuse of the leaked information had been confirmed as of October 7. [ 5 , 8 , 11 ]
- HIS said it learned of the possible leak in late February 2026 but did not announce it for about seven and a half months. [ 5 , 9 ]
Confirmed by several sources
- HIS announced on October 7 that unauthorized access at its Thai subsidiary may have leaked up to 627 people's passport information. [ 2 , 3 , 4 , 5 , 6 , 7 , 8 , 9 , 10 , 11 ]
- The leaked data may include passport numbers, alphabetized names, signature-field names, gender, dates of birth and expiry dates, while addresses, phone numbers and credit card details were not included. [ 2 , 5 , 8 , 9 , 10 ]
- The customers affected departed for Thailand from Japan using HIS in 2017, 2019-20 and 2024-25. [ 2 , 5 , 8 , 9 , 10 ]
- The unauthorized access at the Thai subsidiary's server was detected in December 2025. [ 5 , 6 , 7 , 8 , 9 ]
- HIS said no misuse of the leaked information had been confirmed as of October 7. [ 5 , 8 , 11 ]
Still unclear
- The exact number of people affected is not settled; HIS describes the figure as up to 627 people. All documents use an upper-bound figure, and HIS has not given a final confirmed count.
- Whether passport images leaked and how many. Only Asahi Shimbun mentions leaked passport images in part, and it says HIS did not disclose the number.
- When the unauthorized access itself occurred. ITmedia says the file server was accessed without authorization in November 2025, while other outlets say the access was detected in December 2025.
- Whether the leaked data has been or will be misused. HIS says no misuse has been confirmed, leaving the possibility open.
What local media are saying
Timeline, local time
- Livedoor News publishes a short item saying up to 627 customers' passport information may have leaked after unauthorized access at HIS. [ 1 ]
- ITmedia reports HIS's announcement, including that the Thai subsidiary's file server was accessed without authorization in November 2025. [ 2 ]
- Tokyo Shimbun reports HIS customer passport information may have leaked in an unauthorized access. [ 3 ]
- Nishi-Nippon Shimbun reports HIS knew of the possible leak in late February 2026 and did not disclose it for about seven and a half months. [ 5 ]
- TBS NEWS DIG reports the leaked data may include dates of birth, passport numbers and signature-field names. [ 6 ]
- Asahi Shimbun reports that passport images were also partly leaked, without disclosing the number. [ 8 ]
- Nippon TV News reports HIS said the delay in disclosure was because the server held large volumes of data unrelated to personal information in varied file formats. [ 9 ]
- A detection tool on the file server raises an alert over unauthorized access, and the server is disconnected from the network to block outside access. [ 2 ]
- HIS confirms the server contains some personal information obtained in Japan. [ 2 ]
- External experts determine that passport information for up to 627 people is present, and HIS decides to check all files on the server. [ 2 ]
- HIS publicly announces the possible leak and says it will contact customers whose details it can trace. [ 2 , 5 , 8 , 9 , 10 ]