Temairazu Data Breach: Why Your Japan STR Manager's Security Literacy Matters More Than Your Software

Unauthorized access to TEMAIRAZU, a channel manager widely used by Japanese accommodation facilities, may have exposed guest booking data. In our view, the real lesson for overseas owners is not about software. It is about whether your local management company can handle phishing and guest inquiries competently.

1. The Bottom Line: Your Management Company Is Being Tested, Not Your Software

A third party gained unauthorized access to TEMAIRAZU, a "site controller" (the Japanese term for a channel manager) that the provider describes as a reservation management system for accommodation facilities. In its second report dated October 7, 2026, the provider, TEMAIRAZU, Inc., said there is a possibility that guests' names, phone numbers, email addresses, property names, check-in and check-out dates, and room rates were viewed or obtained. In its timely disclosure of October 9, the company put the number of people potentially affected at "up to approximately 4.45 million." This is the company's upper estimate as of that date, not a confirmed number of leaked records. The company has also confirmed that messages impersonating properties or booking sites have been sent to guests via WhatsApp, email and SMS, asking them to make payments.

For owners, this means two things. First, guests may contact your property saying, "I received a message in your property's name." Whether your operation can respond to them sincerely and competently will affect your property's reputation. Second, although this incident involved the provider's own systems, attacks that use fake "guest" emails to break into a property's computers and admin panels have been happening for some time, and both the police and major IT companies have issued warnings about them. What is really being tested is the IT literacy of the management company staff who run your property day to day.

Our recommendation is clear. Ask your management company how they handle employee account management, two-factor authentication and phishing prevention. If you do not get clear answers, consider switching managers. We also recommend, so that responsibility is clear if something goes wrong, an arrangement in which the management company holds the hotel business license in its own name. There is no need to change your software on the basis of this incident alone.

2. What Happened: Key Points from the Company's Disclosures

The table below summarizes the sequence of events as published by the company.

Figure 1. TEMAIRAZU incident timeline (2026)

Source: TEMAIRAZU, Inc. releases and timely disclosure. The 11-hour figure is approximate, based on the suspension and restoration times in the disclosure.

"Timely disclosure" is a system under which listed companies must promptly publish material information for investors under stock exchange rules; TEMAIRAZU, Inc. is listed under securities code 2477. The cause and route of entry have not been published "for security reasons," and the investigation is ongoing. The incident has been covered by Japanese media including Travel Voice, INTERNET Watch and NHK. One private security information site counted 105 public announcements by properties and operators confirmed as of October 8. This is a secondary-source tally of announcing parties, not the number of affected properties.

3. Guest Inquiries: A Sincere Response Protects Your Reputation

The fake messages may have been sent by someone who already knew the guest's name, the property name and the stay dates. From the guest's point of view, the message is indistinguishable from "a message from the place I booked." When guests have been scammed, or are simply worried, the first party they contact is the property, not the software provider.

In our view, responding with "This has nothing to do with us" will hurt your reviews and your reputation. What is needed is the ability to carry out the basics, without hesitation and in the guest's own language:

• Explain the situation accurately.
• Tell guests that payments are only ever made inside the OTA (online travel agency platforms such as Airbnb and Booking.com).
• If they have already entered card details, advise them to contact their card issuer, as the provider itself recommends.

Airbnb also states that asking guests to take a booking off Airbnb is a policy violation, and that paying outside Airbnb means losing AirCover protection.

If guests ask for compensation, the right response depends on the facts and on the contracts involved. Do not leave this entirely to your manager; decide in advance who makes the call and how it is reported to you as the owner. For questions of legal liability in individual cases, please consult a lawyer.

4. The Real Risk: Phishing Aimed at the Property Side

One point that is easy to miss in this incident is that attackers do not only target guests.

In March 2026, the Nagano Prefectural Police issued an alert on cyberattacks targeting hotels. It illustrates the flow: criminals send staff an email posing as a guest, get them to click a link that infects their device with malware, steal the login details for travel booking sites, enter the admin panel, and change the bank account to which sales are paid out. In March 2025, Microsoft also reported a phishing campaign impersonating Booking.com that targeted hospitality staff with emails about guest inquiries or negative reviews, delivering credential-stealing malware. Microsoft recommends measures including multi-factor authentication on all accounts.

Figure 2. Two attack paths: guests vs. property staff

Source: Path A based on TEMAIRAZU, Inc.'s second report; Path B based on the Nagano Prefectural Police alert and Microsoft's report. The "Defense" row is our view.

This pattern has been seen in Japan before. In November 2023, the Japan Tourism Agency warned that unauthorized access to Booking.com's reservation management system for properties had led to some travelers receiving messages directing them to phishing sites. In other words, property accounts being breached and guests then being targeted is not new.

In its partner guidance, Booking.com lists "false urgency" as a typical sign of phishing and asks partners to report suspicious cases within 24 hours. It also tells partners never to comply with requests for usernames, passwords or two-factor authentication codes, as part of its guidance on social engineering.

In our view, the last line of defense against these attacks is the front-line staff who open emails and operate the admin panels. However secure your systems are, they can be breached the moment a staff member clicks a link in a fake "guest email." That is why our position is that you should not entrust your property to a management company that is weak on IT.

5. Three Things to Ask Your Management Company

Two-factor authentication means verifying identity with something in addition to a password, such as a code sent to a smartphone. Microsoft recommends multi-factor authentication on all accounts. Use the three questions below to check your manager.

Figure 3. Manager IT-literacy check

Our view: the good answers reflect what we consider clear, specific responses. The red-flag examples are illustrations of answers that do not address attacks aimed at the property side.

Our recommendation is to consider switching any management company that cannot answer these three questions specifically. "The software company has security covered" is not an answer to attacks aimed at the property side, as described by Microsoft and the Nagano police. For more on what a management company should cover and how fees are structured, see "STR Management Fees and the Scope of Services in Japan."

6. Whose Name Is on the Hotel Business License?

One factor often overlooked when thinking about responsibility in an incident is the name on the license. Japan's Hotel Business Act (Ryokan Business Act, the law regulating paid accommodation businesses) requires anyone who intends to operate an accommodation business to obtain a license from the prefectural governor or equivalent authority, and calls the licensed party the "operator." Obligations such as keeping a guest register are placed on the operator. For the difference between this act and the private lodging (minpaku) law, see "Hotel Business Act vs. Housing Accommodation Business Act."

In our view, if the license is in the owner's name and only day-to-day operations are outsourced to a management company, then in an incident like this one it may be the owner, as the license holder, whom guests or authorities ask for an explanation. For an owner living overseas, responding immediately in Japanese is not realistic.

For this reason, we recommend an arrangement in which the management company that runs the property is the license holder and takes responsibility in an incident. However, how the license is held depends on the property's contractual structure (lease or management agreement) and on local government practice. When changing management companies, you also need to check how the license will be handled, for example whether a new license is required or whether a transfer can be approved. Please confirm the actual scope of responsibility with a specialist such as a gyoseishoshi (administrative scrivener, a licensed professional who handles permit applications) or a lawyer.

7. Japan's Personal Information Protection Act (General Overview)

Article 26 of the Act on the Protection of Personal Information requires businesses, when certain types of data leaks occur, to report to the Personal Information Protection Commission (the government body overseeing personal data protection in Japan) and to notify the affected individuals. A business that handles data on behalf of another and notifies that party is exempt from those obligations. Reportable cases include leaks that may have been carried out for improper purposes and leaks involving more than 1,000 people, according to the Commission's guidance. TEMAIRAZU, Inc. says it has reported the incident to the Commission and the police. Whether a property needs to take separate action may depend on the contractual relationships involved, so we recommend checking with a lawyer.

8. Should You Change Your Software?

In our view, there is no need to replace your channel manager on the basis of this incident alone. The published materials concern unauthorized access to this company's systems; they do not state that any other channel manager or PMS (property management system) has been compromised. The company says it has completed countermeasures for the affected area, and you can wait for further reports on its investigation before deciding. For how to approach system selection, see "Guide to Selecting Site Controllers (Channel Managers) for STR Investment in the Japanese Market."

What needs reviewing is not so much the system as the management company that operates it.

9. Conclusion: Choose a Management Company with Strong IT Literacy

This incident does not directly reduce the value of your property. However, how guest inquiries are handled, and how well the operation is prepared for phishing aimed at the property side, are areas where a management company's competence shows directly. Our conclusion comes down to three points:

• Check your management company's IT literacy with the three questions above.
• If they cannot answer, consider switching.
• Have the management company hold the license and the responsibility that comes with it.

The Room sells and operates whole-house properties with year-round Hotel Business Act licenses in Hakone, the Fuji Five Lakes area and Tokyo. If you would like to discuss post-purchase operations or how responsibility should be handled in an incident, please get in touch.