News

[Important] Apology and Notice Regarding a Possible Exposure of Guest Personal Information

Oct.26.26

[Update: October 26, 2026]
[Important] Apology and Notice Regarding a Possible Exposure of Guest Personal Information

October 26, 2026
Kinnotake Co., Ltd.

Thank you for choosing the Kinnotake Group properties.
We have learned that the reservation management system we use, WASIMIL (provided by AZOO Inc.), was accessed without authorization by a third party. As a result, some personal information of guests registered in this system for our properties may have been viewed or obtained.
We have also confirmed that some guests have received suspicious messages (by WhatsApp, SMS, email, etc.) impersonating our properties, which appear to make use of this information.
We sincerely apologize for the concern and inconvenience this has caused.

■ 1. Timeline
October 13, 2026 (Tue), around 6:00 p.m. – early hours of October 17 (Sat) A third party accessed the reservation management system without authorization (according to the system provider's investigation).
October 18, 2026 (Sun) Some guests contacted us about suspicious messages impersonating our properties.
October 19, 2026 (Mon) The system provider fixed the vulnerability that caused the unauthorized access and completed countermeasures.
October 20, 2026 (Tue) The system provider informed us that a third party had exploited a vulnerability in the system to gain unauthorized access.
October 22, 2026 (Thu) We received the system provider's initial investigation report.
* No suspicious access has been detected since October 17. Due to log retention limits, it cannot be confirmed whether there was any access before around September 16, 2026.

■ 2. Information that may have been viewed or obtained
・Name (including kana), gender, age, date of birth, nationality, language
・Address (home or work), phone number, email address, emergency contact
・Reservation details (property name, reservation number, stay dates, room, number of guests, accompanying guests, room rate, payment status, and other details)
・Information entered during online check-in, etc. (allergies, requests and special needs)
* The items registered differ depending on how the reservation was made. Items that were not registered are not affected.
* Of these, names, email addresses, phone numbers, property names, stay dates and booking amounts have been confirmed as actually obtained for some guests, because they appeared correctly in the suspicious messages. It has not been confirmed whether the other items were obtained.
* Credit card information (card number, expiry date, security code) and login IDs and passwords for booking sites are NOT stored in this system and were not exposed in this incident. Passport information was not registered at our properties and is not affected.

■ 3. Who is affected
Guests (including the person who booked and accompanying guests) registered in the reservation management system of our properties on or before October 19, 2026, regardless of when the reservation or stay took place. This includes reservations made through our official website and through online travel agencies. We are contacting affected guests in turn.
Number affected: approx. 13,773 guests
* Provisional figures as of October 21, 2026. Includes cases where the same person is registered more than once, such as repeat guests.

■ 4. About the suspicious messages
The suspicious messages we are aware of:
・arrive by WhatsApp, SMS, email, etc.
・include your name, our property name and your stay dates
・ask you to open a link to "confirm your reservation" and enter your credit card details or the booking amount
・pressure you to act quickly, for example by saying your reservation will be cancelled within 24 hours
・link to fake websites created by criminals (for example, addresses containing "gueststaypending.com")
Our properties do not ask guests to confirm reservations or make payments through WhatsApp, SMS, or other messaging apps. Your reservation will not be cancelled automatically because of this incident.
The stolen information may continue to be misused for weeks or months. Please remain cautious.

■ 5. What we ask of you
If you receive a suspicious message, please:
・not click any links in the message
・not enter your credit card or personal details
・not reply to the message, or make any payment or transfer it asks for
・block the sender, and report it in the app if it came through WhatsApp
To check your reservation, please contact our Reservation Center or the official support of the booking site you used.
If you have already entered information on a linked page:
・Credit card details: Contact your card issuer right away to discuss suspending or reissuing your card. We also recommend consulting the police.
・Payment or transfer: Contact your bank or financial institution right away.
・Password: Change your password, including on any other services where you use the same one.

■ 6. Our response and next steps
・On October 19, 2026, the system provider fixed the vulnerability and disabled the means of access that had been misused. As of October 22, no suspicious access has been detected since October 17.
・The system provider is implementing further measures, including changes to its authentication method, access restrictions on the management screen, and stronger login security.
・We will also strengthen our review and oversight of the security management of our contractors, including the system provider.
・We will work with the system provider to prevent recurrence and strengthen security.
・We have reported this incident to the Personal Information Protection Commission of Japan.
We will promptly post any new information on this page.
Once again, we sincerely apologize for the concern and inconvenience this has caused.

■ Contact us (9:00-17:00 Japan Time)
Property Reservation Centers

Kinnotake Sengokuhara
Phone: +81-460-85-9200
Email: rsv.sengokuhara@kinnotake-resorts.jp

Kinnotake Tonosawa
Phone: +81-460-85-9800
Email: rsv.tonosawa@kinnotake-resorts.jp

Matsuzakaya Honten
Phone: +81-460-83-6511
Email: rsv.matsuzakaya@kinnotake-resorts.jp

Hotel Zagakukan
Phone: +81-465-24-3636
Email: rsv.zagakukan@kinnotake-resorts.jp

Kinnotake Saryo
Phone: +81-460-85-8282
Email: rsv.saryo@kinnotake-resorts.jp

Motoyu Kansuiro
Phone: +81-465-43-8008
Email: rsv.kansuiro@kinnotake-resorts.jp

Kansuiro Bekkan
Phone: +81-465-43-8370
Email: rsv.kansuiro.annex@kinnotake-resorts.jp


--------------------------------------------------
(The following is the notice published on October 22, 2026)


[Update: October 22, 2026]
[Important Notice] Resolution of PHP Vulnerability (CVE-2026-109618)

October 22, 2026
Kinnotake Co., Ltd.

Regarding the critical PHP vulnerability (CVE-2026-109618) reported on October 21, 2026, we would like to inform you that we have completed all necessary security measures for our website and system.

Action Taken: We have applied the latest version updates, disabled affected PHP configurations, and established web security protection via WAF (Web Application Firewall).

We remain committed to maintaining a safe and secure environment for all our visitors.


--------------------------------------------------
(The following is the notice published on October 20, 2026)

[Update: October 20, 2026]
[Important] Notice Regarding Personal Information Leak Due to Unauthorized Access

October 20, 2026
Kinnotake Co., Ltd.

On October 17, 2026, we issued an advisory regarding suspicious emails and messages impersonating our group properties. Subsequent investigations have revealed that an unauthorized external party accessed the Property Management System provided by our third-party vendor, resulting in a leak of a portion of guest information for those with accommodation bookings.

We sincerely apologize for the considerable distress and inconvenience this situation may cause to our guests.

1. Background
A detailed investigation conducted by the vendor operating our Property Management System revealed that the system was subjected to unauthorized access exploiting a vulnerability in the system.

2. Current Status
・The vulnerability that caused the incident was resolved on October 19, 2026.
・We are continuing to work with the vendor to investigate the specific items, volume, and affected period of the leaked information.
・On October 19, 2026, we sent an advisory email to all guests holding reservations as of that date.

3. Important Requests to Our Guests
・Kinnotake Group will never ask you to enter credit card details or make additional payments via a link in an email or message.
・If you receive any suspicious communication, please do not click any links, enter any information, or reply.
・If you have accidentally entered credit card details on a suspicious page, please contact your credit card issuer immediately.

4. Future Actions
We will contact affected guests individually as soon as they are identified. Furthermore, in cooperation with our vendor, we will strengthen monitoring systems and security measures, making every effort to prevent any recurrence. Any updates or new findings will be published on this page as they become available.

[Contact Information]
Kinnotake Group Reservation Center
Email: info@kinnotake-resorts.jp

--------------------------------------------------
(The following is the notice published on October 17, 2026)


October 17, 2026
Kinnotake Co., Ltd.

Thank you for choosing Kinnotake Group.

We have received reports from guests with reservations at our properties, and from business partners, about suspicious emails and messages that use the names of our properties. Similar scams have also been reported across the hospitality industry.

Examples of reported tactics

・Messages that claim to be from our staff but come from unofficial email addresses
・Requests to enter credit card details through a link, for example for “card pre-authorization” or “re-payment to confirm your booking”
・Some messages may include part of your booking details, such as your name or stay dates

Please note

・Kinnotake Group will never ask you to enter card details or make an additional payment through a link in an email or message.
・If you receive a suspicious message, please do not click any links, enter card or personal information, or reply.
・If you are unsure, do not reply to the message. Please contact us directly at the address below.
・If you have already entered your card details, please contact your card issuer immediately.

We are working with the relevant partners to look into these reports and strengthen our security. We apologize for any concern this may cause and appreciate your understanding.


Contact
Kinnotake Group Reservation Center
Email: info@kinnotake-resorts.jp