Times Car breach exposes 6.6 million accounts with driver's license images

Times Car breach compromised personal records of approximately 6.6 million accounts operated by Times Mobility Co., Ltd. The incident involved unauthorized access to the car-sharing platform's web system, with driver's license images confirmed for 1.6 million of those accounts. No credit card data was exposed.

Timeline and scope of the Times Car breach

Unauthorized access was detected at 9:07 a.m. JST on September 25, 2026. The intruder path was blocked by 7:25 a.m. JST the following day. Initial notice of possible exposure came on September 25, followed by confirmation on September 28 that a third party had acquired data from 6.6 million accounts. On September 29, the company verified that identity document images had been taken for roughly 1.6 million accounts.

The affected records cover current and former Times Car members, incomplete applicants, and corporate accounts from Times Business Service. Some entries date back to 2019. Times Car operates Japan's largest car-sharing network, with about 4 million members and 84,000 to 85,000 vehicles as of August 2026. The retention policy at the time of the breach kept identity images for the duration of membership plus seven years after cancellation.

Exposed information varied by account and included names, addresses, dates of birth, phone numbers, email addresses, driver's license details, and identity verification images such as driver's licenses, utility bills, student IDs, and family documents. Passwords were stored in hashed form. Nine partner service IDs were also listed. Corporate records included department names. No credit card information appeared in the exposed data.

Company actions and user implications

Park24 and Times Mobility issued statements confirming third-party access and data acquisition. The companies reported the incident to Japan's Personal Information Protection Commission and local police, retained external forensic investigators, and stated that services continued without interruption. They noted that hashed passwords alone do not allow direct account access and reported no evidence of public distribution or misuse at the time of their notices.

Individual notifications began around September 29 for accounts with identity images. On October 16, the company announced immediate deletion of ID images after registration confirmation and committed to removing all remaining images by the end of October 2026. A further report on investigation results and prevention measures is scheduled for October 23, 2026. Users received guidance to monitor for phishing attempts and were given a support contact number.

Some users have expressed interest in potential class-action claims. Police have indicated that reissuing driver's licenses provides only limited additional protection. The breach highlights risks tied to long-term storage of identity documents in car-sharing and similar services.

Readers evaluating car-sharing platforms after this incident should review current data retention policies and multi-factor authentication options before signing up. Checking official company updates remains the most reliable way to track follow-up actions.