H.I.S. TOURS Thailand unit may have exposed up to 627 passport records

H.I.S. announced that its Thai subsidiary H.I.S. TOURS experienced a possible third‑party unauthorized access that could have leaked personal data, including passport and allergy information for travelers to Thailand in 2017, 2019‑2020 and 2024‑2025. The intrusion was first detected by software on the subsidiary’s file server on 11 December 2025, and investigations later found that data from Japan had been stored on the server. The Personal Information Protection Commission and JIPDEC were notified on 29 December 2025, and on 24 February 2025 the company determined that up to 627 passport records might have been involved.