Times Car Breach: 6.6 Million Accounts and the KYC Problem

Times Car Breach: 6.6 Million Accounts and the KYC Problem

On 28 September 2026, Park24 confirmed what it had only hinted at three days earlier: an intruder had taken data belonging to as many as 6.6 million current and former users of Times Car, Japan's largest car-sharing network. The list of what was taken includes the single item that makes a consumer breach uniquely and permanently unpleasant — images of driver's licences, and of the identity-verification documents behind them.

Times Car is operated by Times Mobility, part of the Park24 Group, and it is a genuinely large rental operation. It had about 4 million active members as of August 2026, lets customers reserve online from 84,000 vehicles and collect them at any of 29,000 stations spread across all 47 prefectures. A data set like that is an identity-theft machine if it ever leaks in the wrong order.

The timeline is unusually tidy, which tells you it was handled well

At 09:07 on 25 September, Tokyo time, Times Car detected unauthorised access to its web system and immediately started investigating with an external specialist. By 07:25 on 26 September, it says the access path was blocked, communications with the attacker cut, and the inaccessibility confirmed. On 28 September it published the investigation results confirming that data was actually taken.

Three things stand out in that sequence. Detection came from monitoring, not from a ransom note or a seller announcement. The containment window was roughly 22 hours. And disclosure of even the possibility of an incident happened in the same month as detection — no quiet quarter of "we are still investigating". That is the pattern the industry keeps asking for and rarely gets.

So this is not a story about sloppy security response. It is a story about what "done reasonably well" still leaves on the table.

What was taken: the identity stack, not the keys

Park24 lists the exposed fields: name; for corporate members, department; address; date of birth; phone; email; driver's licence information; identity-verification document information including images of licences; password; and linked service IDs — nine of them, such as the JR West group's WESTER ID.

Now the password part. Park24 states passwords were stored "in a form that cannot be restored", meaning hashed or encrypted, and that it has confirmed neither a password that could be recognised as such nor any unauthorised account use from this incident. Credit card data was not taken.

The company has done the right things here. A password store you cannot reverse is table stakes. What you should not do is mistake it for the story. The breached system held a page of biographical identity data and a copy of the one document the entire modern account regime is built on. A licence image cannot be "restored" from the attacker's copy — that is the good news — and it also cannot be un-copied, which is the bad news.

The KYC problem hits differently in a mobility company

This is the point worth circling. A car-sharing operator is a KYC company that happens to rent cars. To hand someone the keys, you must first prove who they are, which is why Times Car hoards the one document every identity stack reuses: the licence, and a photo of it, filed alongside an address, a date of birth and a telephone number. That is the identity-verification stack, assembled, in a single account.

Compare it with a credential breach. In a credential breach the attacker walks away with things that can be changed — passwords, recovery emails, tokens — so the damage can be bounded with resets, rotation and locks. The Times Car list is not that. An address, a birthdate and a licence photo are not credentials you rotate. They are biographical. They do not expire when you change your password, and neither does the attacker's copy of them.

That is the data-model lesson. The breach is real because of what the data model was designed to hold, not because of how the password column happened to be protected. "We used non-restorable password storage" answers the question nobody in this incident is asking. The question that matters is why a web system carrying that much identity data also needed the raw verification images and the full personal stack, including a corporate operator's department name, sitting in accounts for people who had already quit the service.

The quiet season of Japan's breach cycle

Japan's disclosure cadence makes this one read differently. In the same news cycle, rail and transit operator Keio confirmed a ransomware attack that disrupted its business systems, and this follows a steady tide of Japanese mobility and consumer companies getting hit. The common thread is data that does not become less valuable the longer it sits. And the dangerous window is the one we are in right now: exfiltration confirmed, distribution not yet confirmed.

That "no evidence of distribution" line deserves to be read precisely. It is not "no distribution happened". It is "we have not seen it". The classic flow is theft, then packing, then sale or a phishing campaign; a public dump site or a forum post is usually one of the last stages, not the first.

Park24 says it will notify affected people individually, in stages, and keep monitoring. Given the phone numbers and email addresses in the loot, the immediate risk is after-market phishing — calls claiming to be Times Car, links that look like membership prompts, password resets that do not ask for the old password. The company's own guidance is the standard one: it will never ask for a password or card details over a message, and neither should the message you just received.

What a Malaysian reader should take from this

Malaysia's own leaks this year — we covered Misi Rakyat's data-leak analysis in July — show the same shape: legitimate systems accumulating identity documents, then a copy of them walking out the gate. Malaysia's PDPA does not yet treat licence images and identity-verification records with the gravity that a reset-and-move-on playbook needs; the PDPA-survival notes for developers we keep as a cornerstone make the same argument.

Three practices separate the operators who are fine after this class of incident from the ones who are not: treat identity-verification imagery as its own data class with its own retention window; keep it out of a web system where a single compromise moves it sideways; and delete ex-member and abandoned-member records instead of holding a quiet reserve of identities you might never use again.

Times Car detected and contained this reasonably quickly, and that part deserves credit. What remains uncomfortable is that the same week showed how readily Japanese companies still run six-million-row identity stores as a by-product of running a convenience business.

Sources

• パーク２４株式会社 (Park24): タイムズカーWebシステムへの不正アクセスに関する調査結果および今後の対応について（第2報）
• パーク２４株式会社 (Park24): 「タイムズカーWebサイト」への不正アクセスによる個人情報漏えいの可能性について（第1報）
• BleepingComputer: Times Car confirms data breach affecting 6.6 million user accounts