The Times Car breach has exposed personal information linked to approximately 6.6 million current and former member accounts. The Japanese car-sharing operator confirmed the theft on September 28, including driver’s license details and identity verification documents.
Former Members Also Fall Within the Breach
Times Car says the incident affects both individual customers and participants in its Times Business Service corporate account program.
Importantly, the affected records include former members as well as current users. The scope therefore extends beyond the company’s reported 4 million active members as of August 2026.
Times Mobility, part of the Park24 Group, operates the service across all 47 Japanese prefectures. Its network includes approximately 84,000 vehicles and 29,000 collection stations.
Despite the breach, the company says its services continue to operate normally.
Driver’s License Images Among Exposed Information
The stolen records contain a broad range of personal and account information, according to the company’s update.
The exposed data includes:
- Full names
- Department names for corporate members
- Home addresses
- Dates of birth
- Telephone numbers
- Email addresses
- Driver’s license information
- Identity verification documents, including driver’s license images
- Account passwords
- Linked service identifiers
However, the investigation found that the incident did not affect credit card information.
Times Car also says it has found no evidence that anyone has distributed the stolen data online. That finding does not establish whether the attackers could share or misuse it later.
Company Gives Limited Details About Password Protection
Times Car described the stored passwords as being in a form that cannot be restored.
However, it did not explain the protection method or provide further technical details. The disclosure therefore leaves uncertainty about how effectively that protection could withstand attempts to recover passwords.
Passwords form only one part of the exposure. The stolen identity documents and contact information also make the incident significant for affected members.
Unauthorized Access Began Earlier in September
According to Times Car, a third party accessed its systems at the beginning of September.
The company publicly disclosed the incident on September 25 while it investigated whether the intruder had obtained personal information.
It then blocked the unauthorized access on September 26. Two days later, an updated notice confirmed the data theft and outlined the affected records.
Meanwhile, an external expert is helping the company investigate the cause and full scope of the Times Car breach.
Members Will Receive Notifications in Stages
Times Car plans to contact affected customers individually, although it will send those notifications in stages.
The company also urged members to treat unexpected emails, text messages and phone calls claiming to represent the service with caution.
In particular, it warned against opening suspicious attachments or entering passwords and credit card details in response to those communications.
0 responses to “Times Car Breach Exposes Data From 6.6 Million Member Accounts”