Thank you very much for your continued use of "Japan Bus Online."

We regret to inform you that unauthorized access by a third party occurred on an API server used for the integration of the highway bus reservation system operated by our company (Kobo Co., Ltd.), and it has been confirmed that some of our customers' reservation information was leaked.

We sincerely apologize for the significant inconvenience and concern this incident has caused our customers and all other parties concerned. We also sincerely apologize for the delay in notifying customers using Japan Bus Online of this incident.

Upon detecting the unauthorized access, our company immediately took measures to block communications to the affected server in order to prevent further damage. Since then, we have confirmed that there has been no continuation of unauthorized access or expansion of the damage.

We would like to report the facts currently known and the measures taken by our company as follows.

1. Overview and Timeline

On October 13, 2026, we detected that suspicious access had occurred between September 16 and September 19, 2026, on an API server that our company manages and uses to provide reservation services (including "Hassha Orai Net" and "Japan Bus Online") to bus operators and other companies.

Our company immediately blocked communications to the affected server in order to prevent further damage. However, we confirmed evidence indicating that some of our customers' reservation information had been leaked externally before these measures were implemented.

2. Customer Information That May Have Been Leaked

• Some reservation information for customers whose bus ticket travel dates fall between July 16, 2026 and November 29, 2026
• Reservation name (customer's name)
• Telephone number
• Bus reservation information (boarding date, route, reservation number, etc.)

* Please note that credit card information, bank account information, addresses, email addresses, passwords, etc., were not stored on the affected server.

3. Maximum Number of Potentially Affected Records

• Number of affected records: 8,341 (final confirmation is currently ongoing)
• Number of affected individuals: 5,614 (final confirmation is currently ongoing)

Of these, the following numbers relate to customers who made reservations through Japan Bus Online. We will notify the affected customers individually via the email addresses registered at the time of their Japan Bus Online reservations.

• Number of affected records: 1,986 (final confirmation is currently ongoing)
• Number of affected individuals: 1,358 (final confirmation is currently ongoing)

4. Reports to Public Authorities and Relevant Parties, and Status of Response

• Reported the incident to the Personal Information Protection Commission of Japan.
• Filed a report with the relevant police department and are fully cooperating with the criminal investigation.
• Completed security measures for the affected server and confirmed that there has been no continuation of unauthorized access or expansion of the damage.
• Reported the situation to the bus operators and travel website operators whose services are connected to our reservation system.

5. Requests to Customers (Preventing Secondary Damage)

At present, we have not received any reports of specific damage resulting from this incident. However, there is a possibility that customers may receive suspicious SMS messages (phishing scams) or calls from unknown numbers using the leaked telephone numbers.

• Neither our company nor bus operators will ever ask customers for PINs, passwords, or credit card information via SMS or other messaging services.
• Please do not access any URLs included in suspicious messages.

6. Contact Information Regarding This Incident

If you have any questions or concerns regarding this incident, please contact us through the inquiry form below.

• Japan Bus Online Contact Form (9:00 a.m. – 6:00 p.m. Japan Standard Time)
  Contact Us