0
The interior of a highway bus in Japan. / Getty Images Bank

A Japanese highway bus reservation website has been hacked, potentially exposing 6,949 sets of credit card information, including card numbers and security codes. It was also revealed that the company took approximately one month to notify customers after detecting irregularities and modifying the website's program.

The Yomiuri Shimbun reported on Nov. 4 that the highway bus reservation website operated by Heisei Enterprise, a bus company headquartered in Shiki, Saitama Prefecture, had been accessed without authorization, potentially exposing personal information entered by users.

According to the company, a user reported an unusual display on the reservation confirmation screen on Sept. 27. An investigation subsequently found that the website's program had been tampered with, leaving information entered by users accessible or retrievable by outside parties.

A total of 15,493 records of personal information, including names, addresses and phone numbers entered between Sept. 13 and 28, may have been exposed. Of these, 6,949 records contained credit card numbers, security codes, cardholder names and expiration dates.

There are also concerns about secondary damage, as information used for online payments, not just contact details, may have been exposed.

The bus company modified the program on Sept. 28 but did not notify affected customers of the potential data leak until Oct. 27.

This means customers were informed nearly a month after the company modified the program following the user's report. During that period, users may have continued using their cards without knowing that their personal information could have been exposed.

The company reportedly received several reports of unauthorized card use and suspicious emails. However, these were reports submitted by users and do not mean that all 6,949 sets of credit card information were actually leaked or used fraudulently.

The bus company apologized, saying, "Deficiencies in our internal reporting system caused the delay in notification," and explained that it had also reviewed its internal reporting procedures.

		0
Large buses line up along a road in Japan. The photo is not directly related to the company or hacking incident mentioned in the article. /Getty Images

The incident is also something Korean travelers who used the company should check. Heisei Enterprise operates the highway and overnight bus brand "VIP LINER." Its official reservation website offers Korean as a language option.

However, it has not been confirmed whether any Koreans were among those affected by the data leak or whether reservations made through the Korean-language interface or other booking agency websites were affected. Simply having traveled on one of the company's buses does not necessarily mean that personal information was exposed. The key date to check is when personal information was entered on the reservation website, rather than when the passenger actually traveled.

The period reported by the Yomiuri Shimbun was Sept. 13–28. Anyone who entered personal or credit card information on the company's website during that period should check their reservation records and any individual notifications from the company. Those who paid with cards issued in Korea should review their overseas transaction records through their card issuers' apps or statements.

Korea's Financial Supervisory Service (FSS), in its guidance on preventing damage from stolen card information overseas, recommends immediately reporting stolen information to card issuers and using payment notification services to detect unauthorized transactions quickly. Japan's National Police Agency also advises anyone who entered credit card information into a service affected by unauthorized access to contact their card issuer promptly.

Anyone notified that their information was affected by the leak or who discovers transactions they did not authorize should report the incident to their card issuer and take necessary measures, such as suspending card use or having the card reissued. Even if a message asks users to re-enter their card information to confirm a reservation or obtain a refund, it is safer to verify the information through the company's official website and the card issuer's customer service channels rather than following links in the message.

                                                                                                          Choi Young-jae