A car-sharing account doesn’t usually require a copy of your driver’s license to open, but Japan’s largest car-sharing service does — and that single design choice is why a breach of 6.6 million accounts at Times Car turned into an exposure of 1.6 million actual identity documents, not just names and email addresses.
Three days from intrusion to full disclosure
Park24, the Tokyo-listed parking and mobility company that owns Times Car through its subsidiary Times Mobility, detected unauthorized access to the Times Car web system at 9:07 a.m. on 25 September 2026. The company cut off the attacker’s access route by 7:25 the following morning — under 24 hours from detection to containment. An initial disclosure followed on 25 September; a fuller update came on 28 September, confirming that identity-verification information, including the driver’s license images Times Car collects to verify new members, had been accessed for roughly 1.6 million of the affected accounts. Park24 reported the incident to Japan’s Personal Information Protection Commission and to police, and says an external forensic team is still investigating how the attacker got in — a detail the company has not yet disclosed publicly.
What makes this breach different from a password dump
The headline count — 6.6 million current and former Times Car and Times Business Service accounts — puts this in the same size class as plenty of other 2026 breaches, including the Pentagon’s DMDC exposure and Thomson Reuters’ C-Track incident. What sets it apart is the category of data at the smaller end of that number. The exposed information spans names, addresses, dates of birth, phone numbers, email addresses, account passwords, and IDs linking nine external partner services — including JR West group member accounts — to a Times Car profile. But 1.6 million of the 6.6 million accounts also had their actual identity-verification documents accessed: driver’s license numbers and scanned images of the license itself.
A leaked password can be reset in seconds. A email address can be changed. A driver’s license number — and a photograph of the physical document bearing someone’s signature, portrait, and license number — cannot be reissued on the same timescale, and in most jurisdictions, cannot be reissued at all without a trip to a government office. Park24 said credit card information was not accessed and that stored passwords were held “in a form that cannot be restored,” language that points to hashing rather than plaintext storage — standard practice, and the one piece of this breach that limits rather than compounds the damage.
Why a car-sharing service holds this much identity data in the first place
Times Car’s business model is the reason the exposure is this severe. Car-sharing requires verifying that the person booking a vehicle actually holds a valid license — unlike a hotel booking or a retail account, it’s a regulatory and insurance necessity, not an optional convenience feature. Times Car operates roughly 84,000 vehicles across about 29,000 stations nationwide, serving around 4 million active members as of August 2026, and every one of those members had to clear an identity check to join. That verification step, done once at signup, leaves a permanent copy of a government-issued ID sitting in Times Car’s systems indefinitely — a tradeoff every identity-verifying service makes, usually without revisiting whether the document needs to be retained after the initial check is complete.
A breach that outgrows its own initial headline
The pattern here — a smaller confirmed number growing as the company’s own investigation continues — is one Tech-Bee has tracked across other 2026 disclosures, including the way Thomson Reuters’ C-Track breach added confirmed jurisdictions in the days after its first notice. Times Car’s own disclosure followed the same shape over a tighter window: the 25 September notice described the intrusion and containment; the 28 September update is where the 1.6 million figure for identity-document access first appeared. Park24 says it is notifying affected users in stages rather than all at once, which means the full scope of what any individual customer should do next may arrive later than the headline breach total did.
The response: a lawsuit forming before the investigation is even done
Within days of Park24’s 28 September update, a Japanese attorney opened a website inviting affected Times Car members to register interest in a joint compensation lawsuit over the breach. More than 15,000 people had signed up within the first week, according to Japan Today’s reporting, with the registration form asking applicants for contact details and any concrete harm they’d experienced since the breach — fraud attempts, phishing contact, or misuse of their identity documents. The suit’s intended basis is straightforward: that Park24 and Times Mobility failed to properly manage the personal information members were required to hand over, by regulation, just to rent a car. Anyone affected can register regardless of whether they’ve since closed their Times Car account, which matters because Park24’s 6.6 million figure explicitly includes former members whose data should, by most data-retention norms, have been deleted long before this breach ever happened.
That detail is worth sitting with on its own. A membership that ended years ago shouldn’t still carry an active liability today — yet for an unknown share of the 6.6 million affected accounts, it did, because the driver’s license image collected to approve that membership was never purged after the business relationship ended.
The lessons that generalise
Identity-verification data is a different liability class than contact information, and breach response should treat it that way. A name and email address support phishing. A verified copy of a government ID supports account takeover, loan fraud, and identity theft that survives every password reset the breached company can offer — credit monitoring, the standard remediation, does little against a stolen driver’s license image.
Any service that collects identity documents for one-time verification inherits an ongoing storage liability it rarely revisits. The verification need is transient — confirm the license is valid, then move on — but the document itself, once collected, tends to sit in the database indefinitely, exposed to exactly this kind of breach for as long as it’s retained for no active purpose.
Fast containment limits new damage, not existing exposure. Times Car’s team cut off the attacker’s access route in under a day, which is a genuinely fast response. It stops the bleeding; it does nothing to recall the data already copied out during the window that preceded detection — a distinction worth remembering whenever a company’s incident response speed is cited as evidence of limited harm.
Data collected for a one-time check should have a deletion date, not just a collection date. A meaningful share of the 6.6 million affected accounts belonged to former members — people whose business relationship with Times Car had already ended. Their driver’s license images stayed in the company’s systems anyway, with no apparent trigger for deletion once the membership that justified collecting them was gone, turning a closed account into exposure that outlived the service it was created for.
Tech-Bee is an independent technology publication. This piece is drawn from Park24’s investor-relations breach disclosure and from reporting by BleepingComputer, Hackread, and teiss on the Times Car data breach.