Notice Regarding the Leakage of Email Addresses Resulting from Unauthorized Access to Arara Inc.’s Email Delivery Service (Second Report)
Following further investigation by Arara Inc., it has been determined that the affected email distribution period was not from October 8, 2026, to October 29, 2026, as originally announced, but from October 10, 2026, to October 30, 2026.
There is no change to the number of affected email addresses (63,006 records), nor to the fact that the only information disclosed was email addresses.
We sincerely apologize for the error in our initial announcement and for the significant concern and inconvenience this incident has caused our customers.
1. Overview
For the distribution of email newsletters and other communications to customers registered as members of the Website, we use an external marketing tool. Emails are distributed through the email delivery service provided by Arara Inc. via that tool.
On November 2, 2026, we received a report that, due to unauthorized access by a third party to the email delivery service provided by Arara Inc., certain email addresses of members of the Website had been disclosed to an external party.
Subsequent investigation has determined that the affected email addresses belong to customers who received emails from “小田急トラベル/Odakyu Travel” or the “小田急旅のサポートセンター/Odakyu Travel Support Center” between October 10, 2026 and October 30, 2026. For details regarding the correction of the affected period, please refer to Section 3, “Reason for the Correction of the Affected Email Distribution Period.”
The information leakage associated with this incident occurred within the email delivery service provided by Arara Inc. At this time, no personal information leakage has been confirmed from the Website or from any other systems connected to the Website.
2. Personal Information Leaked and Number of Records
*With respect to our company, no personal information other than email addresses was included in the affected information.*
3. Reason for the Correction of the Affected Email Distribution Period
Arara Inc. initially reported that data had been extracted from its servers at some point between October 28, 2026 and October 29, 2026. However, subsequent investigation determined that data had actually been extracted between October 28, 2026 and October 31, 2026.
*For details, please refer to the following notice issued by Arara Inc.:
“Important: Apology and Report Regarding the Suspension of Arara Message Services and the Leakage of Personal Information.”(Japanese)
As a result, we conducted a further review of the affected email distribution period and determined that the following correction was necessary.
Previously announced: October 8, 2026 to October 29, 2026
Corrected period: October 10, 2026 to October 30, 2026
4.Email Addresses Affected by the Incident
The affected email addresses are those that received any of the following emails between October 10, 2026 and October 30, 2026. There has been no change to the types of emails affected by this incident. Please note that the following subject lines were sent in Japanese.
・箱根フリーパスのご利用方法について
・特急ロマンスカーについて
・ロマンスカーのご案内
・チェックインのご案内
・チェックインのご案内
・チェックインのご案内
・天成園 ご朝食ビュッフェ内容変更に関するご案内
・セキュリティ対策に伴う小田急トラベルサイト一部領域の公開停止について
・鉄道ツアー情報をお届けします！
・50周年キャンペーン第2弾 開催！おすすめ宿が大人2名最大13,680円OFF！
・宿限定クーポン配布中！「季の湯 雪月花」「水の音」が大人2名最大19,080円OFF！
・本日は10月29日！ 小田急トラベルの日です
・ご利用ありがとうございました
5．Emails Not Affected by the Incident
Customers who received only the following emails are not affected by this incident, as these emails were distributed through an email delivery service different from that used by Arara Inc.
- Booking Confirmation【Booking no.: XXXX】
- Booking Cancellation（予約取消通知）
- Reminder: Check-in is tomorrow | HAKONE TRIP website (Odakyu Official)
6. Current Actions
(1) Reporting to the Personal Information Protection Commission
Arara Inc. reported this incident to the Personal Information Protection Commission on November 2, 2026. We are also taking the necessary actions in response to this incident.
(2) Suspension of Email Distribution
We have suspended email distributions using Arara Inc.’s email delivery service.
The emails listed in Section 5, “Emails Not Affected by the Incident,” continue to be sent because they are distributed through a separate system.
(3) Individual Notification to Affected Customers
We will contact affected customers individually as soon as we are able to identify them and confirm that emails can be delivered safely.
We sincerely apologize for the additional time required to send notifications to affected customers due to the migration to a different email delivery server.
If you are no longer a member of the Website at the time the notification is sent, you will not receive the notification email.
7. Request to Customers
(1) Suspicious Emails
Please be cautious of suspicious emails related to this incident, including those that impersonate our company, Arara Inc., credit card companies, or other organizations, as well as notifications regarding transactions or account activity that you do not recognize.
If you receive any communication that you do not recognize, please do not access any URLs contained in the message, open any attached files, or enter any information such as IDs, passwords, or credit card details.
(2) Further Information Regarding the Incident
For further information regarding this incident involving Arara Inc., please visit the Arara Inc. website.
News:Arara Inc. Website (Japanese)
Second Report:Information Leakage and Service Suspension Due to Unauthorized Access to “Arara Message” (Second Report: Japanese)
Third Report:Information Leakage and Service Suspension Due to Unauthorized Access to “Arara Message” (Third Report: Japanese)
We are continuing to investigate this matter and confirm the details.
At this time, even if you contact us individually, we may not be able to determine or inform you whether your email address was affected by this incident.
We appreciate your understanding.
For inquiries regarding the use of HAKONETRIP or membership registration, please contact:
weborder@odakyu-travel.co.jp
Once again, we sincerely apologize for the significant concern and inconvenience this incident may have caused.
Odakyu Electric Railway Co., Ltd.