Tokyo – Park24, which operates Times Car through its subsidiary Times Mobility, confirmed late October that attackers had accessed personal data belonging to more than 6.6 million current and former members of Japan's largest car-sharing service. The final investigation report, released October 23, puts the incident among the most serious personal data exposures Japan has seen in recent years, with identity documents at the center of the damage.
The stolen data covers names, home addresses, dates of birth, phone numbers, email addresses, and driver's license details for 6,628,007 accounts. For 1,464,800 of those accounts, attackers transmitted encrypted images of identity documents outside the company's systems. Those images included driver's licenses, utility bills used to verify home addresses, student IDs from people enrolled in student plans, and family verification documents for members on family plans. Another 891,602 account holders had their images accessed but not transmitted. In total, roughly 2.36 million identity document files were touched in some form.
- 6.6M: Accounts with personal data accessed
- 1.46M: ID document images transmitted out
- ¥5.5B: Projected special loss
- 64K: Potential class-action claimants
Attackers entered through a vulnerability in the Times Car web application and used what they found there to navigate into the company's underlying database and file storage. Park24 has not named the specific flaw or described the compromised architecture, saying only that the confirmed access path is closed and that systems built the same way were reviewed afterward. The breach was detected at 9:07 a.m. on September 25. By the following morning, the attacker's communication route was cut off.
Times Mobility's Times Club loyalty program was accessed in the same incident. That system contributed 135,436 linked service IDs, 19,510 Times Club card numbers, and the last four digits of 28 credit cards to the exposure. Park24 said it does not store full card numbers or security codes in either system. Four hashed passwords were also transmitted, though the company described them as stored "in a form that cannot be restored."
The financial toll has been significant. Park24 projected a 5.5 billion yen special loss and cut its full-year net profit forecast by 12.5 percent. The company plans to pay 3,000 yen per person, in cash or vouchers, to each of the 1.46 million customers whose encrypted ID images left the system. Daily sales have since returned to pre-incident levels, though the company acknowledged that membership numbers dropped in the immediate aftermath of the disclosure.
A Japanese attorney opened a plaintiff intake site on September 30, and by October 7, roughly 64,000 people had registered as potential claimants. No lawsuit has been filed yet, but the figure is unusually high by the standards of Japan's data-privacy litigation history.
Regulators moved across several agencies. The National Police Agency issued guidance on October 8, warning businesses to tighten identity verification and alerting the public to impersonation scams. The Financial Services Agency followed the next day, asking banks and financial firms to stop accepting uploaded ID photos for account verification ahead of the April 2027 legal deadline and to read IC chips from physical documents instead. Japan's transport ministry instructed the Japan Rental Car Association to survey its members on data protection practices and report back by October 30.
"A reissue is not something that lets you feel safe." [Police official, quoted by Asahi Shimbun, on driver's license replacement]
One consequence without much precedent in Japanese data-protection cases has been a wave of driver's license reissue requests. Because license numbers and photographs are permanent identifiers, prefectural public safety commissions began accepting applications for replacements under the Road Traffic Act. By October 10, at least 16 prefectures, including Aichi, Hiroshima, Miyagi, and Niigata, were processing applications. A reissued license carries a new number and photograph but does not change the holder's name, address, or date of birth, which limits how much protection it actually offers.
Times Mobility changed its retention practices on October 16, announcing it would delete ID images once a registration check is complete for current members and would no longer keep images of former members at all, reversing a policy of retaining them for seven years. The company had cited identity verification needs and the Corporation Tax Act as justification for the extended retention, though tax law does not require keeping license images. All existing images are scheduled for deletion by the end of October.
Times Mobility has held Japan's Privacy Mark certification from JIPDEC since 2021, valid through August 2027. JIPDEC received the incident report and asked for a prompt investigation; its options include issuing a recommendation, suspending the mark, or revoking it.
The breach arrived during a period of rising unauthorized access across Japan. The National Police Agency recorded more than 7,190 such cases in 2025, more than four times the 2021 figure. Nippon Rent-A-Car disclosed a separate intrusion the same week affecting 96 members across two access events, though neither company has suggested any connection between the incidents.
Anyone who ever registered with Times Car, including those who never finished sign-up, should treat their information as having been accessed. The company has said it will never request passwords, SMS codes, or card PINs by phone or message. Its official fraud hotline is 0120-25-8924.