Reports describe unauthorized access affecting overseas-hotel and multilingual Rakuten travel-booking systems, with up to roughly 3.54 million records potentially exposed. The data includes names, email addresses, phone numbers and booking details; around 36,000 records may include limited card information such as cardholder names, expiry dates and final four digits. This does not establish disclosure of complete card numbers or confirmed payment fraud. The operator says it blocked access, improved its systems and plans individual notifications. Customers should verify notices through official channels even when a contact knows their booking details.