Times Mobility, the Park24 Group company that runs Japan's Times Car car-sharing service, has confirmed that a third party took member data from its web system. The company detected the intrusion on September 25, 2026 and on September 28 put the scope at about 6.6 million accounts. On September 29 it added that identity document images were taken for about 1.6 million of those accounts.
According to Park24's first notice, Times Mobility detected unauthorized access to the Times Car web system at 9:07 a.m. on September 25 and found traces of a third party in the system. It disclosed a possible leak the same day. By 7:25 a.m. on September 26 it had blocked the access route, cut communication with the attack source and confirmed the route no longer worked.
The second notice, on September 28, confirmed that member information stored in the affected system had been obtained by a third party. The company has engaged an external firm for a forensic investigation and reported the incident to Japan's Personal Information Protection Commission and to police. Affected people are being contacted individually in stages, and Times Car services have continued to operate.
The company has not said how the attacker got in. Nikkei xTECH reports that the cause, entry route, attacker and the date the intrusion began are all still under investigation, and that the company has received no ransomware-related threats so far. The incident date used for this report is the detection date, not the start of the intrusion, which is not yet known.
The figure of about 6.6 million refers to accounts, not individuals. It covers current and former Times Car members, people who applied but never completed enrollment, and current and former members of the Times Business Service corporate program.
The company says the data taken varies by account and includes name, department name for corporate members, address, date of birth, phone number, email address, driver's license information, identity verification documents, password and linked service IDs. The linked IDs cover nine external services, including JR West's WESTER ID.
In its third notice, Times Mobility confirmed that identity verification documents were taken for about 1.6 million accounts: driver's license images, proof of address images such as utility bills, student ID images for student plan members and family verification documents for family plan members. It began emailing those members on September 29 and expects to give each of them specifics within about two weeks.
Times Mobility states that credit card information was not leaked. Passwords were stored in a form that cannot be restored, and the company says they cannot be used to access accounts. It has found no evidence that the data has been published or misused.
Response speed was not the problem: under 24 hours from detection to containment, with same-day disclosure. The damage was decided earlier, by what the system held. Images collected once, to prove someone could drive or lived at an address, were still stored in the system that was accessed, alongside records for people who had left the service or never finished joining. A password can be reset. A license image and a utility bill cannot, and together they are the raw material for passing someone else's identity check.
Any business that verifies identity at sign-up, from mobility and rental services to fintech and telecom, should ask this week: which verification images do we still hold, for whom, and in which systems reachable from the internet? Useful steps include keeping the verification result rather than the image where the law allows, moving retained documents to a separate store with its own access controls, setting deletion rules for former customers and abandoned applications, and listing every partner ID your platform holds so those partners can be warned quickly. This is data governance work, and retention is the control that limits a breach before anyone detects it.
How the attacker got in, when the intrusion began, who was responsible, how many individuals the 6.6 million accounts represent, and whether the regulator will take action. Times Mobility says it will publish its measures to prevent a recurrence in a later notice.
1. Possible leak of personal information due to unauthorized access to the Times Car website (first report), Park24, September 25, 2026 (updated September 26, 2026). Confirms detection at 9:07 a.m. on September 25, containment by 7:25 a.m. on September 26, the first list of possibly affected data and the report to the Personal Information Protection Commission.
2. Investigation results and response to unauthorized access to the Times Car web system (second report), Park24, September 28, 2026. Confirms data was obtained by a third party, about 6.6 million accounts, who is affected, the data types, nine linked service IDs, password storage, that credit card data was not leaked, the forensic investigation and reports to the regulator and police.
3. Investigation results and response to unauthorized access to the Times Car web system (third report), Times Mobility, September 29, 2026 (updated October 1, 2026). Confirms identity verification documents were taken for about 1.6 million accounts, the document types and the individual notification schedule.
4. Times Car leaks up to 6.6 million personal records, with student IDs affected as well as licenses, Nikkei xTECH, September 2026. Reports that the cause, entry route, attacker and start of the intrusion are under investigation and that no ransomware-related threats have been received.
5. Times Car confirms data breach affecting 6.6 million user accounts, BleepingComputer, September 28, 2026. Corroborates the company notices in English.
