Citybus said a service provider had alerted it to a suspected unauthorised login to a third-party system used to redeem tourist-bus tickets. Its initial investigation found no record of data leakage.
The system held basic details for about 53,000 users, including names and email addresses. Citybus said it had asked the provider to investigate and submit a detailed report, and that the login issue had been resolved.
Citybus said the system did not handle ticket purchases or payments and was separate from the Octopus and other electronic-payment systems used to pay bus fares. Its bus and tourist-bus operations were unaffected.
The company is emailing users who might be affected and advising them to stay alert. It said it would not ask customers by email for passwords or credit-card numbers, or ask passengers to follow unknown links for identity verification.