Times Mobility runs Times Car, Japan's car-sharing service, and is part of the Park24 Group. The company has confirmed that an unknown third party broke into the Times Car web system and took member data for about 6.6 million accounts. Park24's disclosure of September 28 lists the stolen data as names, addresses, dates of birth, phone numbers, email addresses, driver's licence information, identity document details, hashed or otherwise "non-recoverable" passwords, and IDs for linked services. A later update, reported by Agents Stack and in a note.com analysis by ishizakahiroshi, says about 1.6 million of those accounts also lost identity document images. The company says no credit card data was taken. It has reported the breach to Japan's Personal Information Protection Commission (PPC) and to the police. No one has claimed the attack, and how the attacker got in has not been disclosed.
What Happened
Park24's first notice, as summarized by Yaamlabs and Agents Stack, says Times Mobility detected unauthorized access to the Times Car web system at 09:07 JST on September 25, 2026. It found traces of a third party in the system and published a "possible leak" notice the same day. By 07:25 JST on September 26 it had blocked the access route, cut communication with the attack source, and confirmed that the route no longer worked.
The company published three numbered notices, all listed on its Times Club notices page:
- First notice (Sept 25): a possible leak of personal information.
- Second notice (Sept 28): confirmed that a third party had obtained member data, and put the scope at about 6.6 million accounts. Park24 filed this as an investor-relations disclosure the same day.
- Third notice (Sept 29): gave further investigation results, including the count of accounts whose identity document images were taken.
Sources disagree on when the intrusion started. BleepingComputer reports that the attacker accessed the systems "at the beginning of the month," meaning early September. Agents Stack, citing Nikkei xTECH, reports that the start date, the entry route and the attacker's identity are all still under investigation. Given that conflict, treat September 25 as the detection date only. The attacker may have been inside for some time before that.
Times Car services kept running throughout, according to Park24's IR filing. Other notices on the company's Times Club site show what followed:
- Oct 1: a notice that phone lines were congested because of the volume of breach enquiries.
- Oct 14: scheduled maintenance on the driver's licence registration feature.
- Oct 15: a forced re-login for the Times Club app.
The company has not said whether either the maintenance or the re-login is related to the breach.
What Was Taken
Volume:
- About 6.6 million accounts. Park24's IR filing, BleepingComputer, The Japan Times Alpha and the other sources all give this figure. It counts accounts, not people. According to a Park24 press-office interview cited in the ishizakahiroshi analysis, it is the maximum account count and includes duplicates between corporate and individual memberships and from people leaving and rejoining. BleepingComputer notes that Times Car claimed about 4 million active members as of August 2026. The affected set is larger because it also covers former members and people who started signing up but never finished.
- About 1.6 million accounts with identity document images taken. This figure comes from the third notice as reported by Agents Stack and the ishizakahiroshi analysis. According to the ishizakahiroshi analysis, the 1.6 million is a count of accounts, not of individual images.
Data fields (Park24 says the fields vary by account):
- Full name
- Department name, for corporate members
- Address
- Date of birth
- Phone number
- Email address
- Driver's licence information
- Identity document images. Besides driver's licences, these include proof-of-address documents such as utility bills, student IDs for student-plan members, and family verification documents for family-plan members.
- Account password, stored in what the company calls a "non-recoverable" format. It has not named the hashing method.
- IDs for nine linked partner services.
One of the linked IDs is WESTER ID, the membership account of the JR West railway group, according to Yaamlabs and the ishizakahiroshi analysis. JR West says it manages WESTER passwords itself and that they were not exposed.
Who is affected: current and former Times Car members, people who never completed enrollment, and current and former users of the Times Business Service corporate program.
Not affected: credit card data. The company also says it has seen no evidence so far that the data has been published or misused.
Why It Matters
Identity documents cannot be changed. A stolen password can be reset. A stolen driver's licence image combined with a name, date of birth and address cannot. That combination is enough to pass weak eKYC (electronic identity verification) checks, open fraudulent accounts, or rent vehicles in someone else's name. Many Japanese financial and telecom services accept a licence image as proof of identity. Expect the effects of the 1.6 million document leaks to last for years, not weeks.
"Non-recoverable" is not the same as "uncrackable." Times Car's second notice states that because passwords were stored in a non-recoverable form, there is no risk of the leaked data being used to misuse customer accounts. As the ishizakahiroshi analysis points out, a hash that cannot be reversed can still be guessed. Fast, unsalted hashing such as MD5 or SHA-1 is far easier to crack than bcrypt or Argon2, and the company has not said which it used. Until it does, treat passwords that members reused on other services as at risk.
Corporate exposure. The Times Business Service records include department names. That gives attackers a ready-made list of employees, grouped by company and team, to use for business email compromise (BEC) and pretexting against Japanese companies.
Phishing is already likely. Security Arsenal warns that breaches this size are typically followed within days to weeks by credential stuffing, fake breach-notification smishing (SMS phishing), and "compensation claim" lures. Times Car has itself warned members to be wary of messages claiming to come from the company.
The Attack Technique
How the attacker got in is not known. What has been reported:
- Target: the company says it was the Times Car web system. It has not identified a specific application, API or vulnerability.
- No CVE: none has been tied to the incident, according to Security Arsenal.
- No ransom demand: Agents Stack, citing Nikkei xTECH, reports that the company has received no ransomware-related threats so far. Nothing in the sources indicates encryption or extortion.
- Containment: the company describes blocking an "access route" and cutting "communication with the attack source." That points to persistent outbound or interactive access, such as a web shell or a compromised credential path, rather than a single exfiltration request. This reading is ours; the company has not said so.
- Forensics: an external firm is investigating, and Park24 has said it will announce measures to prevent a recurrence later.
Any account that names a specific technique, threat actor or dwell time is speculation until the forensic findings are published.
What Organizations Should Do
- Hunt for credential stuffing now. Watch for login spikes, impossible-travel events and bursts of failed logins against accounts that use email addresses from Japanese consumer domains. Force a password reset for any of your users whose credentials turn up in combo lists over the coming weeks.
- Tighten identity checks that rely on documents. If you onboard customers with driver's licence images, step up verification for new accounts using Japanese IDs. Use liveness checks, read the IC chip on My Number cards or licences, and cross-check addresses. A matching photo ID alone is no longer strong evidence.
- Warn staff about corporate-member phishing. Tell employees who used Times Business Service to expect targeted lures that cite their real department and contact details. Flag inbound messages that impersonate Times Car or Park24, and give staff a single internal reporting channel.
- Check accounts that link to partner services. If your service is one of the nine linked to Times Car, or you accept Times IDs, review sign-ins that came through those links and watch for account takeover attempts that reuse the leaked IDs.
- Treat "non-recoverable" as unverified. In your own risk register, assume the Times Car password hashes may be cracked until Park24 discloses the algorithm and salting. Push MFA or passkeys for any of your users who are likely to reuse passwords.
- Audit your own document storage. Use this incident to review where you keep identity images. Encrypt them with separately managed keys, delete them once verification is done, and keep them out of systems that face the web.
Sources: Car-sharing service hit by data breach affecting 6.6 million accoun... | Times Car confirms data breach affecting 6.6 million user accounts | PARK24 Notice: Personal Information Leak at Consolidated Subsidiary... | お知らせ 免許と一緒に、タイムズクラブ | Times Car Data Breach: 6.6 Million Accounts Exposed — Detection and... | Times Car breach: 6.6M accounts and licence images Yaamlabs | 「復元できない形式で保管」だけでは足りない理由。タイムズカー漏えいの説明から、ハッシュとパスキーを読み直した｜ishizakahiroshi | Times Car breach: 6.6M accounts, ID images Agents Stack