Online travel agency ezTravel announced on November 9 that its system had proactively detected an external cyberattack targeting its membership center on November 7. An initial internal investigation found that contact information from some historical orders had been improperly accessed, affecting more than 690,000 people. The leaked information included consumers’ names, email addresses, contact phone numbers, and product order details. Addressing public concerns about financial security, the company clarified that all payment transactions are handled by a third-party payment gateway, and its initial investigation confirmed that the incident did not involve credit card numbers or member login passwords. ezTravel reported the incident to the relevant authorities within the legally required time limit and activated its response procedures and fraud alerts.
Historical order contact information leaked, affecting more than 690,000 people
EzTravel said its cybersecurity team discovered on November 7 that its member center had been targeted by an external cyberattack, and immediately implemented measures to defend against and block it. According to CNA, an investigation found that the intercepted data primarily consisted of contact information from historical orders, including names, phone numbers, email addresses, and purchased itineraries. More than 690,000 customers were affected in total. The company said it had reported the incident to the competent authorities within the statutory timeframe, in accordance with the Personal Data Protection Act, and had notified affected users by text message and email to increase their awareness of fraud risks.
EzTravel emphasizes that customers' credit card details and passwords were not affected
Regarding payment flows and confidential authentication data, EzTravel explained that online card transactions on its platform are processed through a compliant external third-party payment provider, and that its servers do not store complete sensitive credit card information. Preliminary digital forensics results confirmed that core account security credentials—including credit card numbers, the final three authorization digits, and member login passwords—were not involved in this breach. Existing transaction systems and payment functions remain operational.
EzTravel has blocked abnormal traffic and initiated digital forensics procedures
To prevent further security vulnerabilities, EzTravel has engaged an external third-party cybersecurity team to assist with the incident investigation and digital forensics. The company has also launched a comprehensive internal access-rights review, strengthening its assessment of database access controls, application firewalls, and abnormal traffic monitoring mechanisms to prevent a second intrusion and determine the source and path of the attack.
Consumers should beware of social engineering scams
The leak of historical order details may expose consumers to social engineering scams. Criminals often use precise purchase records to impersonate customer service representatives or financial institutions and trick consumers into using ATMs or providing one-time passwords (OTPs). EzTravel reminds customers that official communications will never include external links. If you receive a message asking you to change a payment deduction or verify an account, contact EzTravel through its official customer service hotline at 412-8001 (add 02 when calling from a mobile phone) to verify it, or call the anti-fraud hotline at 165.
This article, “EzTravel Hacked: Data from More Than 690,000 Orders Leaked,” first appeared at .
【Further Analysis】
【My Further Perspective】
The EzTravel incident highlights the potential risks of how online travel agency (OTA) platforms manage historical data. Although credit card details and passwords were not directly exposed, precise personal information such as names, itineraries, and contact details is enough to serve as high-risk material for social engineering attacks. This shows that businesses must focus not only on the compliance of payment channels, but also on applying a “Zero Trust” architecture to historical data and encrypting data at rest, to prevent sensitive information retained for too long from becoming a target for hackers.
【Market Impact】
- **Taiwan stock market**: The short-term impact on tourism and online platform stocks may be negative, as damage to consumer trust could slightly weigh on order volumes. However, the impact on cybersecurity services and systems integration stocks (such as An-Gi Information and Zero One Technology) may be positive, as demand for vulnerability remediation and forensic services is expected to rise.
- **U.S. stock market**: The impact on cloud security and digital forensics stocks (such as CrowdStrike and Palo Alto Networks) may be positive, as frequent cybersecurity incidents around the world continue to reinforce the resilience of corporate cybersecurity budgets during economic downturns.
- **Cryptocurrency market**: The overall impact is likely to be neutral. However, be aware that criminals may use the leaked precise information to launch targeted phishing attacks against specific victims in an attempt to steal crypto assets.
【What to Watch】
If regulators impose administrative penalties on the companies involved under the Personal Data Protection Act, this could prompt the market to reassess the rising compliance costs facing online retailers. In addition, the final findings of the third-party forensic investigation and the company’s subsequent investment in cybersecurity upgrades will determine how long it takes to restore its brand reputation.
【Risk Reminder】
Investors should be alert to the potential legal compliance and customer attrition risks facing platform companies. Consumers should also be on guard against follow-up social engineering scams involving impersonators posing as platform customer service representatives or financial institutions. Never trust messages asking you to transfer money or provide verification codes.