Times CAR breach exposes 6.6 million accounts and 1.46 million driver's license images
Times CAR / Times Club web systems (Park24, Times Mobility)
Attackers exploited a vulnerability in the web system of Times CAR, the Japanese car-sharing service Park24 runs through its subsidiary Times Mobility. The intrusion was detected on Sep 25 2026. Park24's forensic report on Oct 23 says data for 6,628,007 accounts (names, addresses, birth dates, phone numbers, emails and driver's license information) shows traces of being sent out, along with 1,464,800 encrypted ID document images such as driver's licenses; another 891,602 encrypted images were accessed without signs of transmission. No credit card numbers were stored, and Park24 says it has seen no sale or publication of the data so far. It will pay affected ID-image users 3,000 yen each and is booking a 5.5 billion yen special loss.
Why this severity: About 6.6 million accounts with driver's license details sent out, plus 1.46 million encrypted ID document images; exploited web vulnerability, details withheld
- Started
- Sep 25, 2026
Affected
Not published yet
Fixed in
No fixed release yet
Timeline3
Park24 publishes the forensic results: a vulnerability in the Times CAR web system was exploited. Data for 6,628,007 accounts shows traces of external transmission, as do 1,464,800 encrypted ID document images (891,602 more were accessed only). It will pay affected ID-image users 3,000 yen, delete stored ID images by the end of October and book a 5.5 billion yen special loss.
Park24 discloses the breach: about 6.6 million current and former Times CAR and Times Business Service accounts, including names, addresses, birth dates, phone numbers, emails, driver's license information and ID document images. No credit card data was taken; passwords were stored in a non-reversible format.
Times Mobility, the Park24 subsidiary that runs the Times CAR car-sharing service, detects unauthorized access to its web system at 9:07 a.m. and blocks the access route by 7:25 a.m. the next day.
Advisories2
News & write-ups3
Notes & caveats
Park24 says the exploited intrusion route has been fixed and systems with the same setup were checked. The ID images were encrypted, but the company says it cannot fully rule out that they are decrypted in future. Partner-service IDs from the related Times Club web system were also sent out. A law office is organising a damages lawsuit and says more than 90,000 people have signed up.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
