2026-11-09
Hello. This is Travolution Inc., the operator of Orderect.
We have confirmed that, on two occasions on November 6 and November 8, 2026, some customer information in our reservation management system was leaked due to abnormal access by an unauthorized third party. We sincerely apologize for the concern this has caused you.
■ First, please beware of impersonation
- Emails, text messages or phone calls impersonating Orderect may be sent to you in connection with this incident. Please do not respond to any message that asks for payment, card details or passwords, or that contains links from unknown sources.
- We never ask for card details or passwords by email, text message, phone or messenger. We only request additional booking information from our official email addresses (@orderect.com, @bankoftrip.com).
■ 1. When and how it happened
- On November 6 and November 8, 2026, an unauthorized third party abnormally accessed our reservation management system and viewed reservation information without authorization, as a result of which some customer information was leaked. We identified each incident on the same day and blocked the access.
■ 2. Personal information involved (this may differ for each customer)
- Bookings affected: mainly bookings with dates of use from 2022 to 2026
- Booker's name, email address, phone number, nationality, and booking details (order number, product, date of use, number of people)
- For some customers: additional information entered when booking
- Most bookings involved only the booker's name and booking details; email addresses and phone numbers were included for only some bookings.
- Payment card or bank account information and passwords were not included.
■ 3. Our notice to you
- We are sending individual notices to the email address used for booking to customers whose information has been confirmed as leaked.
- You can check whether your information was included on our 'Check My Information' page: enter the email address you used for booking, and use the verification code sent to that address. https://www.orderect.com/privacy-check
■ 4. What we have done
- We blocked the intrusion route and the related accounts, replaced our servers and major security keys, and invalidated all issued access rights.
- We have strengthened login and access restrictions and are continuously monitoring our security.
- We have reported the incident to the relevant authorities as required by law and are cooperating fully with their investigation.
■ 5. What we ask of you to prevent harm
- Please check or change your booking only through the Orderect website or our official customer support.
■ 6. Reporting damage and inquiries
- Customer Support Team: cs@orderect.com
■ 7. Remedies
- Claim for damages: If you suffer damage due to a violation of the law by a personal information controller, you may claim damages in a civil lawsuit without having to prove intent or negligence.
- Claim for statutory damages: If personal information is leaked due to intent or negligence, you may claim damages in a civil lawsuit without having to prove the actual amount of damage.
- Personal Information Dispute Mediation Committee (Korea): www.kopico.go.kr / +82-1833-6972
- Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr / +82-2-118
We take this incident very seriously. Working with the relevant authorities, we will identify the exact cause and prevent any further harm. We will also review and strengthen our entire security system so that this does not happen again.
If anything you should know is newly confirmed during the investigation, we will promptly inform you through this notice and individual notices.
We sincerely apologize once again for the concern and inconvenience caused. Thank you.
November 9, 2026
Inho Bae, CEO, Travolution Inc.