Notice Regarding Information Leakage

26 October 2026
THE JUNEI HOTEL Kyoto
THE JUNEI HOTEL Kyoto Gosho Nishi

We have learned that WASIMIL, a hotel management system provided by an external company (AZOO Inc.) and used by our hotels for reservations and guest management, was subject to unauthorized access by a third party, and that the personal information of guests who have stayed with us or hold a reservation with us may have been exposed as a result.

We sincerely apologize for the great concern and inconvenience this has caused our guests.
In connection with this incident, we have confirmed cases in which guests received suspicious messages (via WhatsApp, email, etc.) impersonating our hotel and asking them to enter credit card details. Please read the warning below first, and do not open links in suspicious messages or enter your card details.

The facts confirmed to date and the actions we are taking are set out below.

Messages that misuse leaked reservation details (name, stay dates, amount, etc.) and impersonate our hotel to request credit card details or payment are being sent via WhatsApp and email. These messages were not sent by our hotel or by the system provider. They are fraud committed by a third party.

What our hotel does not do
•    We never ask you to pay or “re-confirm” by a deadline on the grounds that “verification is required to keep your reservation” or that “your reservation is under review.”
•    We never send advance payment links to guests who have booked with payment at the property.

Features of the fraudulent messages confirmed so far
•    WhatsApp messages from overseas phone numbers (e.g. +44)
•    Your actual reservation details (name, stay dates, amount) are correctly stated
•    Links to domains that are not ours (juneihotel.com), such as “gueststaypending.com”
•    Requests to enter card details under the pretext of “reservation confirmation” or “review”

What we ask of you
•    Do not open links in suspicious messages, and do not enter card details or personal information.
•    If you are unsure whether a message about your reservation is genuine, contact our official contact details (at the end of this page) directly, not the contact details in the message.
•    If you have already entered your card details, contact your card issuer immediately to block the card and report the fraudulent transactions. We also recommend that you consult the police (in Japan: Cybercrime Consultation Desk #9110; overseas: the police in your country of residence).
•    If you receive a suspicious message, please let us know with a screenshot. We will use it for our investigation and for requesting the takedown of fraudulent websites.
Please note that credit card information is not included in the information that may have been leaked (the system does not store card information). Card fraud has occurred where guests entered their card details on a fraudulent website.

1. Summary of the incident
WASIMIL, a hotel management system provided by AZOO Inc. (Tokyo), to which our hotels outsource the management of guest information, was subject to unauthorized access by a third party exploiting a vulnerability in its externally exposed functions. Guest information registered in the system may have been viewed and obtained.

    
From around 18:00 on 13 October 2026 to the early hours of 17 October 2026 (Japan time). Unauthorized access and data downloads from three IP addresses were confirmed during this period

Affected system    
WASIMIL hotel system provided by AZOO Inc. (externally exposed functions such as the booking engine and guest portal)

Detection by the system provider    
Initial report received on 17 October 2026; leak confirmed on 19 October 2026

Report to our hotel  
 Initial notification from the system provider on 20th October 2026; preliminary incident report received on 22 October 2026

Remediation of the vulnerability    
Completed on 19 October 2026. No further unauthorized access has been detected since

According to the system provider, due to the log retention period, it is not possible to confirm whether any access occurred before around 16 September 2026. We have requested that the provider report on this point as part of its investigation findings.

2. Information that may have been leaked
Because it is not possible to identify individually which information was actually obtained, in accordance with the rules of Japan’s Personal Information Protection Commission we treat all information that was “accessible” through the unauthorized access as “information that may have been leaked.”


All guests (including the person who made the reservation and accompanying guests) whose information was registered in our hotels’ WASIMIL system on or before 19 October 2026, regardless of the booking channel (our official website, booking sites, telephone, etc.) or the date of booking.


Personal details    Name, gender, age, date of birth, nationality, language
Contact details    Email address, telephone number, address, emergency contact
Stay details    Reservation number, stay dates, room, number of guests, accompanying guests, amount, payment status, notes such as requests
Other    Information entered at online check-in (allergies, special requirements, etc.)


•    Credit card information (card number, expiry date, security code): not stored in the system.
•    Passport numbers and passport images: our hotels do not register passport numbers in the system; the number of guests affected is zero.
According to the system provider’s investigation, it has been confirmed that, for at least some guests, the name, email address, telephone number, property name, stay dates and reservation amount were actually obtained.

3. Cause
According to the system provider’s investigation, a third party exploited a vulnerability in the externally exposed functions of the WASIMIL hotel system (booking engine, guest portal, etc.) to view and obtain guest information that should not have been accessible. Our hotels’ internal systems and accounts were not compromised.
The cause has been identified and the vulnerability was remediated on 19 October 2026.

4. Current response
Actions on the system side (by the system provider)
•    On 19 October 2026, remediation of the vulnerability was completed and the access route used in the attack was disabled
•    Database connection credentials were reissued and monitoring was strengthened
•    As of 22 October 2026, it has been confirmed that there has been no access from the IP addresses used in the attack, no use of the disabled access route, and no large-scale data download

Actions by our hotels
•    In place of individual notification to each guest, this public notice and the dedicated contact point below serve as notification of this incident
•    We have requested the takedown of the fraudulent websites that have been identified and have filed a report with the police
•    We will further strengthen the security of the systems that handle guest information and will continue to apply two-factor authentication
Reporting to the authorities

A preliminary report was submitted to the Personal Information Protection Commission of Japan, the competent authority in Japan, by AZOO Inc. as of 20 October 2026. Once the investigation is complete, a final report will be submitted jointly in the names of our hotels and AZOO Inc.

5. Measures to prevent recurrence

•    The authentication method for externally exposed functions has been changed to short-lived tokens scoped to each property (implemented)
•    Introduction of a mechanism that limits access scope for each guest
•    Retirement of legacy connection routes and reissue of connection credentials
•    IP address restrictions on access to the administration console and migration to passkey authentication


•    We will require the system provider to conduct a third-party vulnerability assessment and report the results, and we will review its security management status on a regular basis
•    We will review the security measures of all external service providers used by our hotels
•    We will strengthen information security training for our staff

6. Contact for inquiries about this matter
For questions about this incident, to report a suspicious message you have received, or to check whether your information is affected, please contact us at the details below.

THE JUNEI HOTEL Kyoto
Email: info.kyoto@juneihotel.com / Tel: +81-75-525-0050

THE JUNEI HOTEL Kyoto Imperial Palace West
Email: info@juneihotel.com / Tel: +81-75-415-7774

Once again, we deeply apologize for the great concern and inconvenience this incident has caused our guests. We regard the protection of our guests’ personal information as our highest priority and will do everything in our power to prevent a recurrence.

• 記事一覧へ戻る
• 次の記事ヘ