Times Car (Park24) breach: data from about 6.6 million accounts stolen, including ID document images
Times Car, Japan's car-sharing service, says data from about 6.6 million current and former accounts was stolen, including driver's licence details and ID images. Passwords were stored unreadably and cards were not exposed. Be wary of messages claiming to be Times Car.
If you have or had a Times Car account, treat unexpected emails, texts or calls claiming to be from Times Car with suspicion, and don't open links or enter passwords or card details. Contact Times Car on 0120-25-8924 or through its inquiry form if you have questions about your account.
What’s happening
Park24, the operator of Japan's Times Car car-sharing service, detected unauthorised access to its Times Car web system on 25 September 2026 and blocked it by the next morning. On 28 September it confirmed that data from about 6.6 million current and former Times Car and Times Business Service accounts had been taken. The data varies by person and includes names, addresses, birth dates, phone numbers, email addresses, driver's licence information and images of ID documents. Park24 says passwords were stored in a form that cannot be restored, and credit card information was not exposed. On 23 October, Park24 said its forensic investigation found a vulnerability in the web system was exploited. It said about 1.46 million encrypted ID images showed signs of being sent out, and about 892,000 more were accessed but not sent. Affected customers with signs of both access and transmission are offered 3,000 yen. BleepingComputer reported the access began in early September, which Park24's pages do not state. No misuse or publication of the data has been confirmed.
- What
- Breach
- Affects
- Times Car car-sharing service (Park24 / Times Mobility, Japan)
- Fixed in
- Nothing to patch
- Since
- 25 Sept 2026
Timeline
- Update
Park24's forensic investigation found a vulnerability in the Times Car web system was exploited. About 1.46 million encrypted ID images showed signs of being sent out, and about 892,000 more were accessed but not sent. Those with both access and transmission get 3,000 yen in cash or vouchers, and further security measures are planned by year-end.
- Update
BleepingComputer reported the breach and said a third party had access from the beginning of September, which differs from Park24's detection date of 25 September. No attacker claim or publication of the data was reported.
- Vendor revisedNothing to patch
Park24 confirmed data was taken from about 6.6 million current and former Times Car and Times Business Service accounts. It listed names, addresses, birth dates, contact details, driver's licence information and ID document images, and said card data was not exposed. It reported the incident to Japan's privacy regulator and the police.
- UpdateNothing to patch
Park24 says it had blocked the access route and cut the attacker's connection by 7:25 on 26 September. It has seen no new unauthorised access since.
- Made publicNothing to patch
Park24 detected unauthorised external access to its Times Car web system at 9:07 on 25 September and said a third party may have obtained member data. The first notice did not give a number of accounts.
Sources
- Times Car Web system unauthorised access: second report (28 Sept 2026)Park24 · 28 Sept 2026
- Possible personal data leak from the Times Car website: first reportPark24 · 25 Sept 2026
- Times Car confirms data breach affecting 6.6 million user accountsBleepingComputer · 28 Sept 2026
- Japan's Park24 details Times Car breach, offers paymentsMLex · 23 Oct 2026