On October 7, HIS announced that the file server of its Thai subsidiary, “H.I.S. TOURS,” had been subject to unauthorized access by a third party, and that customer passport information and other data may have been leaked.
The information that may have been compromised includes passport details (full name, name in the signature field, gender, date of birth, passport number, and expiration date), as well as allergy information, for up to 627 travelers who departed for Thailand via HIS in 2017, 2019–2020, and 2024–2025. The company states that the data does not include phone numbers, addresses, email addresses, or credit card information.
Here is the background: On December 11, 2025, an alert was triggered by the unauthorized access detection software installed on the file server at our Thai subsidiary, prompting us to block external access. Upon further investigation, it was determined that some data may have been improperly extracted.
Subsequently, the company reported the incident to the Personal Information Protection Commission and the Japan Information Economy and Society Promotion Association (JIPDEC), an accredited personal information protection organization, and after completing a thorough review of all files, decided to make this announcement.
Regarding the reason why the investigation and disclosure took so long, the company explained that the server contained a large amount of data unrelated to personal information—such as accounting records—which made automated processing difficult, necessitating a careful, manual review and verification of each individual data point.
HIS states that it will contact affected customers individually on a rolling basis, while also working to strengthen security at its overseas offices and tighten the system monitoring framework at its headquarters to prevent a recurrence.
© Source travel watch