Mt Ruapehu skifield has made changes to its website to stop people accessing other people's personal information.
Since April, cardholders have been able to access personal information on the website by entering someone's name and date of birth.
On Thursday, the Office of the Privacy Commissioner contacted the company, which reconfigured its website that night to protect the information with a password.
Ruapehu Alpine Lifts general manager Dave Mazey says they mistakenly thought they were complying with the Privacy Act.
He says until Thursday they had received no complaints or comments from customers and there was no financial information on the website.
