# Times CAR breach exposes 6.6 million accounts and 1.46 million driver's license images · pwn.watch > Attackers exploited a vulnerability in the web system of Times CAR, the Japanese car-sharing service Park24 runs through its subsidiary Times Mobility. The intrusion was detected on Sep 25 2026. Park24's forensic report on Oct 23 says data for 6,628,007 accounts (names, addresses, birth dates, phone numbers, emails and driver's license information) shows traces of being sent out, along with 1,464,800 encrypted ID document images such as driver's licenses; another 891,602 encrypted images were accessed without signs of transmission. No credit card numbers were stored, and Park24 says it has seen no sale or publication of the data so far. It will pay affected ID-image users 3,000 yen each and is booking a 5.5 billion yen special loss. Page: https://pwn.watch/i/park24-times-car-data-breach-6-6m-accounts · generated 2026-10-29T06:46:19.334Z ## Status - Severity: high · status: live · patch: partial - Product: Times CAR / Times Club web systems (Park24, Times Mobility) - Started: 2026-09-25 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/park24-times-car-data-breach-6-6m-accounts/feed.xml - JSON Feed: https://pwn.watch/i/park24-times-car-data-breach-6-6m-accounts/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/park24-times-car-data-breach-6-6m-accounts.json - This file: https://pwn.watch/i/park24-times-car-data-breach-6-6m-accounts/llms.txt ## Updates (newest first) - 2026-10-23: Park24 publishes the forensic results: a vulnerability in the Times CAR web system was exploited. Data for 6,628,007 accounts shows traces of external transmission, as do 1,464,800 encrypted ID document images (891,602 more were accessed only). It will pay affected ID-image users 3,000 yen, delete stored ID images by the end of October and book a 5.5 billion yen special loss. (https://www.timesmobi.co.jp/news/2026/10/bca8b21d0fc52c552c3ac8e04a631177ef4cd31c.html) - 2026-09-28: Park24 discloses the breach: about 6.6 million current and former Times CAR and Times Business Service accounts, including names, addresses, birth dates, phone numbers, emails, driver's license information and ID document images. No credit card data was taken; passwords were stored in a non-reversible format. (https://www.park24.co.jp/news/files/3f5f7768d2de73e7ff4dd66993b781df.pdf) - 2026-09-25: Times Mobility, the Park24 subsidiary that runs the Times CAR car-sharing service, detects unauthorized access to its web system at 9:07 a.m. and blocks the access route by 7:25 a.m. the next day. (https://www.park24.co.jp/news/files/3f5f7768d2de73e7ff4dd66993b781df.pdf) ## Fix brief # Security brief: Times CAR breach exposes 6.6 million accounts and 1.46 million driver's license images Source: https://pwn.watch/i/park24-times-car-data-breach-6-6m-accounts · status: live · severity: high · updated Oct 29, 2026, 02:46 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Attackers exploited a vulnerability in the web system of Times CAR, the Japanese car-sharing service Park24 runs through its subsidiary Times Mobility. The intrusion was detected on Sep 25 2026. Park24's forensic report on Oct 23 says data for 6,628,007 accounts (names, addresses, birth dates, phone numbers, emails and driver's license information) shows traces of being sent out, along with 1,464,800 encrypted ID document images such as driver's licenses; another 891,602 encrypted images were accessed without signs of transmission. No credit card numbers were stored, and Park24 says it has seen no sale or publication of the data so far. It will pay affected ID-image users 3,000 yen each and is booking a 5.5 billion yen special loss. Severity detail: About 6.6 million accounts with driver's license details sent out, plus 1.46 million encrypted ID document images; exploited web vulnerability, details withheld - Product: Times CAR / Times Club web systems (Park24, Times Mobility) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes There is nothing to patch. If you have or had a Times CAR or Times Business Service account, expect phishing and impersonation that use your name, address and license details, and treat unexpected messages about the 3,000 yen payment with suspicion: check Times Mobility's official site instead of clicking links. ## Latest updates - Oct 23, 2026: Park24 publishes the forensic results: a vulnerability in the Times CAR web system was exploited. Data for 6,628,007 accounts shows traces of external transmission, as do 1,464,800 encrypted ID document images (891,602 more were accessed only). It will pay affected ID-image users 3,000 yen, delete stored ID images by the end of October and book a 5.5 billion yen special loss. - Sep 28, 2026: Park24 discloses the breach: about 6.6 million current and former Times CAR and Times Business Service accounts, including names, addresses, birth dates, phone numbers, emails, driver's license information and ID document images. No credit card data was taken; passwords were stored in a non-reversible format. - Sep 25, 2026: Times Mobility, the Park24 subsidiary that runs the Times CAR car-sharing service, detects unauthorized access to its web system at 9:07 a.m. and blocks the access route by 7:25 a.m. the next day. ## Advisories - [Notice Regarding Unauthorized Access at a Consolidated Subsidiary's System and Personal Data Breach](https://www.park24.co.jp/news/files/3f5f7768d2de73e7ff4dd66993b781df.pdf) (PARK24 Co., Ltd.) - [タイムズカーWebシステムへの不正アクセスによる個人情報漏えいに関するご報告と今後の対応について（第5報）](https://www.timesmobi.co.jp/news/2026/10/bca8b21d0fc52c552c3ac8e04a631177ef4cd31c.html) (Times Mobility) ## Write-ups & news - [タイムズカーの見舞金は3000円、146万件に送信痕跡　漏洩原因は脆弱性悪用](https://xtech.nikkei.com/atcl/nxt/news/24/03437/) - [Park24 to pay ¥3,000 to Times Car users hit by data breach](https://www.japantimes.co.jp/business/2026/10/24/park24-3000-yen-compensation/) - [Times Car reporting ¥5.5 billion loss has firms bracing for data breach fallout](https://www.japantimes.co.jp/business/2026/10/28/companies/data-breach-business-risk/) ## Caveats Park24 says the exploited intrusion route has been fixed and systems with the same setup were checked. The ID images were encrypted, but the company says it cannot fully rule out that they are decrypted in future. Partner-service IDs from the related Times Club web system were also sent out. A law office is organising a damages lawsuit and says more than 90,000 people have signed up. --- Machine-readable: https://pwn.watch/i/park24-times-car-data-breach-6-6m-accounts.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.