News

[Important Notice] Resolution of PHP Vulnerability (CVE-2026-109618)

Oct.22.26

[Update: October 22, 2026]
[Important Notice] Resolution of PHP Vulnerability (CVE-2026-109618)

October 22, 2026
Kinnotake Co., Ltd.

Regarding the critical PHP vulnerability (CVE-2026-109618) reported on October 21, 2026, we would like to inform you that we have completed all necessary security measures for our website and system.

Action Taken: We have applied the latest version updates, disabled affected PHP configurations, and established web security protection via WAF (Web Application Firewall).

We remain committed to maintaining a safe and secure environment for all our visitors.


--------------------------------------------------
(The following is the notice published on October 20, 2026)

[Update: October 20, 2026]
[Important] Notice Regarding Personal Information Leak Due to Unauthorized Access

October 20, 2026
Kinnotake Co., Ltd.

On October 17, 2026, we issued an advisory regarding suspicious emails and messages impersonating our group properties. Subsequent investigations have revealed that an unauthorized external party accessed the Property Management System provided by our third-party vendor, resulting in a leak of a portion of guest information for those with accommodation bookings.

We sincerely apologize for the considerable distress and inconvenience this situation may cause to our guests.

1. Background
A detailed investigation conducted by the vendor operating our Property Management System revealed that the system was subjected to unauthorized access exploiting a vulnerability in the system.

2. Current Status
・The vulnerability that caused the incident was resolved on October 19, 2026.
・We are continuing to work with the vendor to investigate the specific items, volume, and affected period of the leaked information.
・On October 19, 2026, we sent an advisory email to all guests holding reservations as of that date.

3. Important Requests to Our Guests
・Kinnotake Group will never ask you to enter credit card details or make additional payments via a link in an email or message.
・If you receive any suspicious communication, please do not click any links, enter any information, or reply.
・If you have accidentally entered credit card details on a suspicious page, please contact your credit card issuer immediately.

4. Future Actions
We will contact affected guests individually as soon as they are identified. Furthermore, in cooperation with our vendor, we will strengthen monitoring systems and security measures, making every effort to prevent any recurrence. Any updates or new findings will be published on this page as they become available.

[Contact Information]
Kinnotake Group Reservation Center
Email: info@kinnotake-resorts.jp

--------------------------------------------------
(The following is the notice published on October 17, 2026)


October 17, 2026
Kinnotake Co., Ltd.

Thank you for choosing Kinnotake Group.

We have received reports from guests with reservations at our properties, and from business partners, about suspicious emails and messages that use the names of our properties. Similar scams have also been reported across the hospitality industry.

Examples of reported tactics

・Messages that claim to be from our staff but come from unofficial email addresses
・Requests to enter credit card details through a link, for example for “card pre-authorization” or “re-payment to confirm your booking”
・Some messages may include part of your booking details, such as your name or stay dates

Please note

・Kinnotake Group will never ask you to enter card details or make an additional payment through a link in an email or message.
・If you receive a suspicious message, please do not click any links, enter card or personal information, or reply.
・If you are unsure, do not reply to the message. Please contact us directly at the address below.
・If you have already entered your card details, please contact your card issuer immediately.

We are working with the relevant partners to look into these reports and strengthen our security. We apologize for any concern this may cause and appreciate your understanding.


Contact
Kinnotake Group Reservation Center
Email: info@kinnotake-resorts.jp