Myrealtrip Data Breach: Names, Phone Numbers and, for Some Users, Passport Numbers Exposed

Confirmed on the 25th, announced on the 29th

The company says it confirmed on Oct. 25 that an unauthorized outsider had accessed its system in an abnormal way. The notice went up on its website on Oct. 29.

What got out and what did not

The exposed items are name, email, mobile number, date of birth, gender and an encrypted password. Passport number and expiry date apply to some users only, and the items differ from person to person.

Payment details such as credit cards, and booking and purchase history, were not among them.

Check on the Myrealtrip site

The website has a dedicated page to look up whether you were affected and which items were exposed.

The total number of affected users has not been disclosed; the company is still counting.

What to do now

The company advises against clicking links in suspicious texts or emails and asks users to change their passwords, including on other sites that share the same one.

With names and phone numbers out, it also warns of voice phishing, smishing and identity theft.

The company's response and your options

Myrealtrip says it blocked the IP and access route as soon as it saw the access, inspected its systems and reported the incident to the Personal Information Protection Commission and other authorities. It promises follow-up notices.

Users who suffered actual damage can claim damages or ask the Personal Information Dispute Mediation Committee for mediation.