【HANAORI】Apology Notification of The Possibility of Customer’s Data Breaches

28th of June, 2024

Dear All Customers

オリックス・ホテルマネジメント株式会社
箱根・芦ノ湖 はなをり

Apology Notification of The Possibility of Customer’s Data Breaches

In Hakone Ashinoko HANAORI (Address: Hakone, Kanagawa, General Manager:
Wakayama Satoshi), operated by ORIX Hotel Management Corporation (Headquarters:
Minato, Tokyo, Company President: Takaaki Nitanai), we know there is a possibility of the data breaches of customers who stayed and book.
We apologize for the trouble and concern for all customers and all those it may
concern.
We report everything that happened until now and future policy as follows.

1. Circumstances
On 18th of June, we found that the part of the customers who booked our hotel
through Booking.com got some unintended message. We checked the admin panel of
Booking.com and found the scam mail, which may lead to external sites not related to
Booking.com and our hotel to some guests who will stay with. On the same day, we have issued a warning notification to our guests in our official website※1. As a result of the change in Booking.com setting, after 20th of June we could not investigate the suspicious mail sent to our guests mail afterward.
We are investigating on the details, however, there is a high possibility that the incident was caused by an external cyber-attack on our facility.
In the personal data that has the high possibility to be breaches, information about bank account or credit card were not included. Also, until now, we have not received any notification that customer information has been misused or that any financial damage has been incurred.
※1 Notice on 18th of June, 2024 (ORIX Hotel Management Corporation）(in Japanese)
※1 Notice on 18th of June, 2024 (Hakone Ashinoko HANAORI）

2. Details of personal information which has a possibility of data breaches
The number of cases : About 3,400 cases※2
Target group : Customer who stayed at our hotel on or after 19th of June, 2023 and
who have a reservation of our hotel as of 31st of December, 2024 (Including the customer
who canceled the reservation)
Category of information : Name, Address, Telephone number
※2 The number of the reservations from the time we found the suspicious access until the change in Booking.com settings.

3. Future Action
We request that you please be careful of any direct mailings or fraudulent phone
calls that may lead you to believe that Booking.com or Hakone Ashinoko HANAORI is
the sender.
And, if you have any questions or inquiries regarding this case, please contact us at
the following address.
【Customer Inquiries】
Hakone Ashinoko HANAORI
Tel : 0460-83-8739
Reception hours : 9:00~19:00 ※We accept applications on Saturdays, Sundays, and
national holidays.

4. Regarding the disclosure
We take this matter very seriously and will promptly establish and thoroughly implement
measures to prevent a recurrence. We will make further announcements as new
incidents become apparent.

Sincerely