CTRIP, China’s biggest online tourism site with over 140 million users, has fixed a loophole in its website where users’ payment information was leaked, the Nasdaq-listed company said yesterday.

WooYun.org, a website specializing in reporting loopholes, said at the weekend that it managed to download the credit card payment information, such as identity card numbers and bank card data, of 93 users from Ctrip.com, thereby exposing the loophole in the latter’s website. The users hold credit cards with China Merchants Bank.

Ctrip said yesterday that it conducted a thorough inspection and fixed the loophole.