In September 2026, a large-scale unauthorized access incident occurred at Times Car, resulting in the leakage of approximately 6.6 million records of account information—including those of former members—as well as driver’s license images. The backdrop to this incident includes a management structure that retained personal information for extended periods beyond the retention requirements for transaction records, as well as vulnerabilities in the web system.

Timeline of the 6.6 Million Account Leak and Unauthorized Access

At 9:07 AM on September 25, 2026, Times Mobility, the operator of the “Times Car” car-sharing service, detected unauthorized external access to its web system. The company immediately launched an investigation and, by 7:25 AM the following day, September 26, successfully blocked the intrusion route of the unauthorized access and severed communication with the attack source. Subsequently, in a second report on September 28, it was officially announced that a third party had acquired a portion of member information. The number of leaked accounts totals approximately 6.6 million, and it has been revealed that the scope is extensive, including not only active members currently using the service, but also users who previously canceled their memberships, individuals who abandoned the application process midway, and members of the corporate service Times Business Service. The leaked data includes names, addresses, dates of birth, phone numbers, email addresses, driver’s license information, passwords, and linked service IDs. The company noted that no credit card information leak has been confirmed, and since passwords were saved in an unrecoverable format, the risk of direct unauthorized use is considered low. Approximately 22 hours passed from the detection of the unauthorized access to the completion of the communication block, and it is analyzed that a large volume of data was likely exfiltrated externally during this period. Please refer to the diagram below for the timeline of events leading up to the discovery of the leak.

The Leak of 1.6 Million Driver’s License Images and the Background Behind Retaining Former Users’ Data

The third report on September 29 revealed even more serious facts. It was confirmed that the number of accounts containing leaked identity verification document images, such as driver’s license images, reached approximately 1.6 million. In addition to driver’s licenses, the image data includes current address verification documents, student IDs, and family verification documents, covering critical information such as the individuals’ portrait photos, license numbers, and expiration dates. A major point of debate in this incident is the fact that even the driver’s license images of users who had already closed their accounts were leaked. According to a response from parent company Park24 to inquiries, transaction records such as the names and addresses of former users were retained because there is a 7-year retention obligation under Article 126 of the Corporation Tax Act and its enforcement regulations. However, it turned out that there is no obligation under the Corporation Tax Act to retain the driver’s license images themselves, and they had been independently kept for 7 years for the purpose of preventing impersonation and handling past inquiries. The lack of data governance, where identity verification images of former users and incomplete registrations were placed in the same database area as the active web system in a manner close to indefinite storage, has drawn criticism as the root cause that magnified the scale of the damage.

The risk of secondary damage such as fake communications and spoofed contracts

The leakage of driver’s license images and personal information raises major concerns about secondary damages, such as phishing scams using suspicious emails and text messages. Vigilance is required against tactics that impersonate Times Car, the police, or financial institutions, guiding users to malicious sites through fake notices such as “Check if you are affected by the leak” or “Re-registration of identity verification is required” to steal PINs and credit card information. In addition, the leakage of names, dates of birth, addresses, and driver’s license images as a set has pointed to the risk of fraudulent applications made to financial institutions and mobile carriers. However, in recent years, the adoption of eKYC—which mandates IC chip reading or live facial capture for identity verification in non-face-to-face transactions—has been progressing, and cases where fraudulent contracts are immediately established using only the surface image of the ID are considered limited. As a self-defense measure that users can take, registering a “self-declaration” with credit information agencies such as JICC, CIC, and the Japanese Banks’ Individual Credit Information Center is recommended. Although the self-declaration requires a total fee of about 2,200 yen and cannot completely prevent fraudulent contracts, it is expected to have a certain deterrent effect by serving as a warning during screening. Please refer to the figure below for the procedures to handle suspicious communications.

Spillover Effects on the Stock Market and Structural Challenges in the Car-Sharing Industry

Share Price Plunge of Parent Company Park24 and Market Reaction

Following the announcement of a massive personal data breach, shares of the parent company, Park24, plummeted in the stock market. When the second report regarding the data leak was released on the afternoon of September 28, 2026, concerns among investors rapidly grew regarding future earnings deterioration, loss of brand image, and the incurrence of compensation costs. In the Tokyo stock market the following day, September 29, Park24 shares (TSE Prime: 4666) continued to fall sharply, with selling pressure mounting as the stock temporarily dropped 5% compared to the end of the previous week. Although the company announced reports to the Personal Information Protection Commission and the police, as well as the implementation of a forensic investigation by an external specialized agency, strong skepticism remains regarding a management system that retained driver’s license images of unsubscribed users for seven years, and the market’s aversion has not subsided. Looking at examples of past large-scale data breach incidents, the burden of costs associated with individual notifications to victims, response to inquiries, and the fundamental restructuring of security systems is unavoidable, and the medium- to long-term impact on management is being closely watched. Furthermore, risks leading to customer churn and the cancellation of corporate contracts have been pointed out, and prompt and transparent information disclosure is in demand to restore trust.

The Rapidly Growing Car-Sharing Market and the Barrier to Maintaining Service Quality

Japan’s car-sharing market continues to expand, driven by the need for seamless mobility and rising demand for secondary transportation in tourist destinations. According to aggregated data from the top five companies as of December 2025, the number of stations nationwide exceeded 32,000—a 20.3 percent increase year-on-year—while the total number of vehicles surpassed the milestone of 70,000, up 18.6 percent. Driving this market growth is industry leader Times Car, which has expanded on an overwhelming scale, increasing its number of stations by 30.2 percent and its fleet size by 25.0 percent. However, behind this rapid business expansion, the issue of declining service quality has surfaced. In the 2025 Car Sharing Service Customer Satisfaction Study conducted by J.D. Power, overall satisfaction dropped by 23 points from 690 points the previous year to 667 points, marking a deterioration for the second consecutive year. Among users, dissatisfaction is growing regarding a sense of effective price hikes due to inflation and the difficulty of making reservations at popular stations. The addition of the recent security incident has highlighted structural issues where the development of system safety measures and customer management systems has failed to keep pace with rapid scale expansion.

Future Developments and Key Points to Watch for Restructuring Data Governance

The recent unauthorized access incident at Times Car goes beyond a mere technical vulnerability of its website, leaving a critical lesson in corporate data lifecycle management. The biggest point of focus moving forward will be the content of the recurrence prevention measures the company plans to announce and the drastic restructuring of its data governance. Specifically, it will be essential to thoroughly enforce network separation (segmentation) between active web servers and the internal databases storing identity verification documents, and to tighten data disposal rules to securely and completely erase the data of former members and those whose registration was not completed. Furthermore, across the industry as a whole, a review of non-face-to-face identity verification methods and the shift to public personal authentication services utilizing My Number cards are expected to accelerate. In accordance with the policies of the National Police Agency and the Financial Services Agency, identity verification methods relying solely on images are being successively phased out or scaled down, making it an urgent task to raise the baseline of security standards. How rapidly growing mobility service providers will balance the pursuit of convenience with advanced information protection—and their stance on these efforts—will dictate their future market competitiveness.

Reference Page

• [Investigation Results Regarding Unauthorized Access to the “Times Car Website” and Future Measures (Second Report)] https://share.timescar.jp/news/2026/0928/1815.html
• [Investigation Results Regarding Unauthorized Access to the “Times Car Website” and Future Measures (Third Report)] https://share.timescar.jp/news/2026/0929/1816.html

[#TimesCar #PersonalInformationLeak #UnauthorizedAccess #Park24 #CarSharing #Security #DataGovernance]