The ezTravel data breach is the unauthorised access to booking information of more than 690,000 members of ezTravel, a Taiwanese online travel agency, disclosed by the company on 9 November 2026. The data that may have been exposed includes names, email addresses, phone numbers and purchase or order details from past bookings. Credit card numbers, card security codes, account passwords, passport numbers and national identification numbers were not involved, and payment processing was not affected. As of the end of 2025, the ezTravel app had been downloaded more than 4 million times and more than 70 percent of bookings were made through the app, according to Taiwan News, citing the Commercial Times.
Detection and disclosure#
ezTravel detected unusual external network activity targeting its membership system on Saturday 7 November 2026 and blocked the suspicious traffic, according to the company's statement as reported by Focus Taiwan. The company released its statement on Monday 9 November, and the Taipei Times reported the same sequence of detection on Saturday and disclosure on Monday. The affected count of more than 690,000 was set after cross-checking records and removing duplicates, according to BreachNews, so the figure counts people rather than bookings or records. The activity targeted the membership system, the part of the platform that holds customer records, and payment processing was not affected.
Data exposed and data not exposed#
The exposed data may include four fields: names, email addresses, phone numbers and purchase or order details from past bookings. ezTravel used the word "may" because the preliminary investigation had not established the full extent of what was taken, and the company described the information as improperly accessed rather than confirming exfiltration of every record. Names, email addresses, phone numbers and real order details are the material used for impersonation scams, and ezTravel warned customers about that risk.
| Data type | Status in the breach |
|---|---|
| Names | May have been exposed |
| Email addresses | May have been exposed |
| Phone numbers | May have been exposed |
| Purchase and order details | May have been exposed |
| Credit card numbers | Not involved |
| Card security codes | Not involved |
| Account login passwords | Not involved |
| Passport numbers | Not involved |
| National identification numbers | Not involved |
Investigation and official reporting#
ezTravel apologised for the concern caused to consumers and pledged to safeguard customers' personal information, according to Focus Taiwan. The company hired an independent cybersecurity team to investigate the incident and conduct a digital forensic analysis, and it reported the incident to the relevant government agencies and police under Taiwan's personal data protection laws. The company did not name a threat group, describe an attack vector, or say how the attackers first reached the membership system. No attribution has been published. No confirmed misuse of the exposed data and no financial losses have been reported in the company's initial statement.
Notification and scam warnings#
ezTravel notified affected customers by text message and email. The company warned that scammers might impersonate customer service or bank representatives to obtain credit card details or verification codes, or trick customers into using ATMs or clicking suspicious links, according to EconoTimes. The warning named specific tricks: fake customer service calls, bank staff impersonation, requests for verification codes, and ATM operations to cancel instalment payments. The company said it would never ask customers to disclose account passwords or verification codes, or to use ATMs to cancel instalment payments. BreachNews reported that official notifications about this incident do not include website links, according to local reporting of the company's guidance, so a message about this breach that contains a link is not an official notification. Customers with questions can call ezTravel's service line at 412-8001, adding 02 from a mobile phone, or Taiwan's 165 anti-fraud hotline.
Steps for affected members#
Unexpected calls, texts or emails about ezTravel bookings should be treated with suspicion, even when the sender knows a real order detail. Card numbers and one-time verification codes should never be shared over those channels. The steps to take after an address appears in a breach are set out in what to do when your email is in a data breach. The exposed order details give phishing messages real material to work with: a message can name a real destination, a real travel date or a real booking reference. Those details do not show the message is genuine. The mechanics of that kind of attack are covered in how phishing uses a leaked email.
ezTravel said it will never ask customers to disclose account passwords or verification codes, or to use ATMs to cancel instalment payments. A call, text or email that asks for any of those is not from ezTravel.
Customers who want to know whether their address appears in known breaches can check with the method in which website leaked my email. Changing the ezTravel account password is a reasonable precaution even though passwords were not exposed, because the same password may be reused elsewhere, and customers who reused their ezTravel password on other services should change it on those services too. The question of whether a new email address is needed after a breach is answered in should you change your email after a data breach.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
The wider pattern in Taiwan#
Taiwan's Ministry of Digital Affairs (MODA) said on Wednesday 11 November 2026 that recent attacks on more than 10 businesses and platforms affected more than 1 million personal records, including names, phone numbers, email addresses and order details, according to Focus Taiwan. Ministry officials said preliminary investigations linked nearly half of the attacks to AI, and some attack traffic appeared to originate from Hong Kong. The wave began around mid-September, with the first cases reported in South Korea, and it was still ongoing when MODA spoke on 11 November. MODA declined to name the affected businesses. The companies named here come from their own disclosures, not from MODA: e-commerce service provider 91APP said up to 4.8 million consumers could have been affected, and ezTravel reported more than 690,000 affected members. MODA did not confirm whether either company was included in its tally of more than 1 million records, so the ezTravel figure should not be counted as part of that total.
What remains unknown#
The investigation is still preliminary. The attack vector is undisclosed, no threat group has been named, and no attribution has been published. It is not known whether the data was exfiltrated or only accessed, or which records were confirmed exposed rather than suspected. No confirmed misuse of the exposed data has been reported, and no financial losses have been linked to the breach. No standalone English incident page from ezTravel was found, and the company has not said when the forensic investigation will conclude or whether a final report will be published. Further detail from ezTravel or MODA would change the picture.
