By Huang Yi-ching / Staff reporter, with CNA
Online travel agency ezTravel （易遊網） on Saturday detected an abnormal external cyberattack on its member center, resulting in the unauthorized access of contact information from historical orders of more than 690,000 customers.
While a preliminary investigation showed that the breach did not involve credit card numbers, the company urged customers to remain vigilant against scams.
In a statement yesterday, ezTravel said that it immediately activated its cybersecurity defense and response mechanisms after detecting the attack, and successfully blocked the abnormal traffic.
It has also commissioned a third-party cybersecurity team to assist with the investigation and conduct digital forensics, the company said.
The compromised data potentially include names, e-mail addresses, phone numbers and product order information from historical records, ezTravel said.
After cross-referencing and removing duplicates, the number of affected customers exceeded 690,000, it said.
The agency has reported the incident to the competent authorities and police within the legal timeframe in accordance with personal data protection laws, it added.
The incident did not compromise credit card numbers, security codes or account passwords, nor did it leak customers' passport or ID card numbers, meaning the security of all financial transactions remains unaffected, ezTravel said.
The company apologized for the anxiety and concern caused to consumers, adding that it does not take threats to customer data security lightly and would not shirk its responsibilities.
Consumers have been notified via text messages and e-mails to warn of potential risks, ezTravel said.
Scam rings might use the stolen order information to impersonate customer service representatives or bank staff, it said.
Scammers often use excuses such as "abnormal orders" or "duplicate charges" to trick consumers into providing credit card information and SMS verification codes, or instruct them to operate ATMs and click on malicious links, it added.
The travel agency reminded its customers that it would never ask for account passwords or verification codes, or instruct them to operate an ATM to cancel installment payments via phone call, text message or e-mail.
新聞來源：
TAIPEI TIMES