What happened
Times Mobility, the Park24 Group company that runs Japan's Times Car car-sharing service, detected unauthorized access to its web systems at 9:07 a.m. on September 25, 2026 and says it cut off the attacker on September 26.
On September 28 it confirmed that data from about 6.6 million current and former accounts had been taken, including members of its Times Business Service corporate program. Park24 later told MLex this is the maximum number of potentially affected accounts and the final count is still under investigation.
What data was affected
It varies by account: names, addresses, dates of birth, phone numbers, emails, driver's license details and passwords (which the company says were stored in a non-recoverable form).
A September 29 update confirmed access to identity verification documents tied to about 1.6 million accounts: driver's license images, utility bills used as proof of address, student IDs and family verification documents. Card data was not affected. The entry point is still under investigation and there was no evidence yet of publication or misuse.
Why it matters
ID document images are ideal material for identity fraud and fake account openings, and unlike a password they cannot be changed.
What to do now
- Users: change your password, distrust contacts impersonating Times Car and watch for accounts opened in your name.
- Companies collecting documents: set a deadline to delete images after verification.
- Separate document storage from the main web system and monitor bulk downloads.