Cyber Incident Victim: Almex
Date:
Dec 2019
Location:
Japan
Summary
A Japanese love hotel booking service experienced a significant data breach, exposing sensitive customer information including email addresses, pseudonyms, birth dates, gender, phone numbers, login credentials, physical addresses, and payment card details. The compromised entity suspended services while investigating the incident and urged affected users to change passwords reused across other platforms. The nature of the service heightened risks of identity fraud, blackmail, and extortion due to potential exposure of patrons' discreet activities, particularly given societal concerns around infidelity.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In December 2019, Almex, operator of the Japanese love hotel booking site HappyHotels[dot]jp, disclosed a data breach exposing sensitive customer information. Attackers compromised guest data including email addresses, handle names, birth dates, gender identifiers, telephone numbers, physical addresses, login credentials, and credit card details. The company suspended its service immediately upon discovering the incident to investigate the cause and implement corrective measures. Almex issued a public apology acknowledging potential customer anxiety and specifically warned users to change passwords on other platforms if they had reused credentials from the compromised service. The breach posed significant risks due to the nature of love hotels, which prioritize anonymity through features like contactless check-in systems designed to protect guest privacy.
The exposure of personally identifiable information created substantial potential for identity fraud and financial crimes through misuse of payment details. More critically, the breach carried elevated blackmail risks given Japan's cultural context surrounding love hotels, where patrons might include individuals engaging in extramarital affairs or seeking discretion. Contemporary surveys cited in reports indicated approximately 38% of Japanese women reported experiencing partner infidelity, with 31% admitting to cheating themselves—statistics underscoring the societal vulnerability to extortion stemming from this breach. While Almex confirmed the theft of credential data and implemented service suspension as containment, the disclosure did not specify the attack vector, duration of unauthorized access, or exact number of affected accounts. No evidence emerged publicly regarding subsequent misuse of the stolen data at the time of reporting.