Key takeaways

  • Park24 (パーク24), whose group company runs Times Car (タイムズカー), Japan's largest car-sharing service, confirmed on September 28, 2026 that attackers took member data from its Times Car web system.
  • About 6.6 million accounts are affected. They include former members and people who applied but never completed sign-up.
  • The stolen data includes names, addresses, dates of birth, phone numbers, email addresses, driver's license details and images of identity documents such as driver's licenses, and passwords stored in what Park24 calls a non-recoverable form.
  • In a third report on September 29, Park24 said images of identity documents were taken for about 1.6 million accounts. They include driver's licenses, proof-of-address documents such as utility bills, student IDs and family verification documents. It has started emailing those members.
  • Credit card data was not taken, according to Park24. It has seen no sign so far that the data has been published or misused. Car-sharing services are running normally.
  • Park24 says it will decide on compensation after the investigation. Japan's transport ministry has asked the rental car industry to check its data protection, and about 64,000 people have signed up for a planned class action.
  • At least a dozen prefectures now let people worried about the leak get a new driver's license, with a new photo and license number. Police say it does not undo the leak.
  • On October 16, Times Car said it will stop keeping identity document images once a member's registration has been checked, and will delete all the images it holds by the end of October.
  • On October 23, Park24 published its final investigation: an exploited web system vulnerability, 6,628,007 accounts taken, and encrypted ID images sent out for 1,464,800. Those customers will get ¥3,000, and Park24 expects a ¥5.5 billion special loss.

Update, October 27: The planned group lawsuit is moving ahead. At a press conference on October 26, the plaintiffs' counsel said more than 100,000 people had registered, and that the suit, in the Tokyo District Court, would seek ¥50,000 for each person whose ID images leaked and ¥30,000 for others, calling the ¥3,000 payment far too low. See After the breach. We compare Park24's payment with other Japanese cases in What Japanese Companies Pay Data Breach Victims.

Update, October 23: Park24's outside investigation is complete. It says attackers exploited a vulnerability in the web system, then used information they found inside to reach the database and file storage. Encrypted ID images were sent out for 1.46 million accounts, and a further 890,000 were accessed. A second system, Times Club, was also accessed. Park24 will pay ¥3,000 to those whose images were sent out and is booking a ¥5.5 billion special loss. See The final investigation.

Update, October 17: Times Car will delete all the identity document images it holds by the end of October, and stop keeping them after registration. The detailed report on what was taken has been postponed to October 23. See Times Car stops keeping license images.

Update, October 11: Several prefectures have started reissuing driver's licenses with a new photo and number to people worried about the leak. See Can I get a new driver's license? Our October 8 update added Park24's Q&A and the transport ministry's request; see Park24's Q&A and After the breach.

What happened#

According to Park24's three reports:

Date and time (JST) Event
Sep 25, 09:07 Park24 detects unauthorized access to its systems and starts investigating
Sep 25 First report: personal data of Times Car members may have leaked
Sep 26, 07:25 Entry path cut off, and communication with the attacker blocked and confirmed
Sep 28 Second report: investigation confirms member data was taken; about 6.6 million accounts affected
Sep 29 Third report: identity document images taken for about 1.6 million accounts. Park24 starts emailing those members

Park24 is working with outside forensic investigators and has reported the incident to the Personal Information Protection Commission and the police. It began emailing members whose identity documents were taken on September 29, and says it will send each of them the details of what was taken in about two weeks, once the outside investigation is complete. It will publish its measures to prevent a recurrence in a later report.

What was taken#

Who is affected

  • Times Car members and former members, including people who applied but did not complete membership for some reason
  • Members and former members of Times Business Service, the corporate version of the service

What data was taken (varies by person)

Data Notes
Name, address, date of birth, phone number, email address
Department name Corporate members
Driver's license information
Identity document information Including driver's license images
Password Stored in "a form that cannot be restored", according to Park24
Linked service IDs IDs for nine partner services, such as JR West's WESTER ID

What was not taken, according to Park24: credit card information.

Identity document images (third report)

Park24 confirmed on September 29 that identity document images were taken for about 1.6 million accounts, roughly a quarter of the 6.6 million. The images confirmed as taken are:

  • Driver's license images
  • Proof of current address, such as a utility bill
  • Student ID images, for student plan members
  • Family verification document images, for family plan members

Times Car requires a Japanese driver's license. Its FAQ says foreign and international driving permits are not accepted for sign-up. So the affected people are those who hold a Japanese license, including foreign residents of Japan.

The final investigation#

Added October 23, 2026.

On October 23, Park24 published the results of the outside forensic investigation, which it says is now complete.

How it happened. Attackers exploited a vulnerability in the Times Car web system. Once inside, they explored the system and used information they found there to get into the database and file storage. Park24 is not disclosing the attack method or the system design, to avoid helping other attackers. It says the confirmed path has been closed, systems with the same setup have been checked, and monitoring has been strengthened.

What was taken, final counts.

Times Car web system Accounts
Name, address, date of birth, phone, email, driver's license information: accessed and sent out 6,628,007
Encrypted ID document images: accessed and sent out 1,464,800
Encrypted ID document images: accessed, but no sign they were sent out 891,602
Corporate members' department names 3,677
Hashed passwords sent out 4
Times Business Card numbers / linked service IDs / member numbers 113 / 4 / 8

The 6.6 million includes some customers who only rent parking through the corporate Times Business service, because their contracts are managed in the same system. The number of linked service IDs is down from nine to four, and none belongs to JR West's WESTER ID, which Park24 had listed in September.

A second system, the Times Club web system for Park24's general membership program, was also accessed: 135,436 linked service IDs, 19,510 Times Club card numbers, the last four digits of 28 credit cards, and names, addresses and license details for 5 people. Park24 says it does not hold full card numbers or security codes.

The images. The ID images were stored encrypted, so Park24 says the traces do not mean their contents could be seen. But it cannot rule out that the encrypted files sent out will be decrypted in future. The earlier figure of about 1.6 million has become 1.46 million sent out, and 2.36 million accessed in total.

Payment and cost. The 1.46 million customers whose encrypted images were sent out will receive ¥3,000 in cash or vouchers; the method has not been decided. Park24 expects a special loss of ¥5.5 billion for payments and response costs, and has cut its full-year net profit forecast by 12.5%. It says membership numbers were affected right after the disclosure, but daily sales are back to pre-incident levels.

Governance. A committee led by Park24's outside directors, with outside experts, will review internal control and governance. Park24 will publish its security and governance measures around the end of the year.

What the final report tells other companies#

In our view, three points stand out:

  • The cost of keeping data. Most of the ¥5.5 billion follows from the ID images: the payment goes only to customers whose images were sent out. Images that Park24 has now decided it never needed to keep after sign-up, which we discussed above, have turned into the largest single cost of the breach.
  • Encryption helped, but not enough to say "no risk". Storing the images encrypted is why Park24 can say they were not immediately viewable. But it still treats them as leaked, because the attackers took the files and may one day read them. Park24 has not said where the decryption keys were kept or whether the attackers reached them. That is the question that decides how much protection the encryption gave.
  • A foothold becomes a database. The attackers used what they found inside the web system to reach the database and file storage. This is the same pattern we saw at Studio and Arcadia: credentials or settings kept on an internet-facing system turn one vulnerability into full access.

What we don't know yet#

Park24 has not said:

  • Which vulnerability was exploited, and how long the attackers had access before detection on September 25
  • Whether the decryption keys for the ID images were reachable from the compromised system
  • Whether this is a ransomware or extortion case. As of October 23, we have not seen Park24 or Times Car on ransomware leak sites tracked by ransomware.live
  • How the passwords were stored, beyond "non-recoverable"

Our analysis#

License images cannot be changed#

A leaked password can be changed. A leaked driver's license image cannot be undone. It contains a name, address, date of birth, photo and license number in one document, which is exactly what is needed to impersonate someone. That can mean opening accounts or signing contracts with services that still accept an uploaded photo of an ID as proof of identity. Park24's third report makes this concrete. For about 1.6 million accounts, the images taken include not only licenses but utility bills that prove a current address, and student IDs. A license plus a proof-of-address document is the kind of pair many services ask for when checking identity online. For those members, the long-term risk is identity misuse, not just phishing.

Why keep data on people who left or never joined?#

The affected accounts include former members and people who never finished signing up. Japan's Act on the Protection of Personal Information asks businesses to make efforts to delete personal data without delay once it is no longer needed. There may be legitimate reasons to keep some records for a period, such as dealing with traffic violations or disputes after a rental. But identity document images of people who never became customers are hard to justify. This breach is a reminder that data you no longer hold cannot be stolen.

Added October 2, 2026. Park24 has since explained its retention to ITmedia NEWS. It keeps former members' names, addresses and dates of birth for seven years to meet record-keeping duties under the Corporation Tax Act. But it said the license images were also kept for seven years for a different reason: "preventing impersonation and handling inquiries". The tax law does not require them. Data on people who never completed sign-up was kept for the same reasons. A legal duty to keep transaction records does not explain keeping images of identity documents, still less keeping them where an intrusion into the web system could reach them.

Times Car stops keeping license images#

Added October 17, 2026.

On October 16, Times Car announced that it had reviewed how it holds identity document images and changed its rules:

Before From now
Current members Kept for the whole membership Deleted as soon as the registration check is complete
Former members Kept for seven years after leaving Not kept
Images already held All deleted by the end of October 2026, whether or not the member asks

It says it had kept the images to check identity at registration, deal with suspected misuse and answer inquiries, and that it followed its own rules and retention standards. Weighing the risks of holding them, it decided to stop.

In our view, this is the right decision, and the most useful thing to come out of this breach for other companies. It shows that the images were not needed to run the service once a member had been checked: the business case for keeping them for years did not survive a serious look at the risk. Many Japanese services that collect photos of licenses and other ID for online sign-up keep them in the same way. They can make the same decision without waiting for a breach. It does not help the 1.6 million accounts whose images were already taken, but it means a future intrusion will not find them.

Fast, specific disclosure#

Park24 published its first report the same day it detected the access. It said plainly that data "may have" leaked, and listed the kinds of data involved. Three days later, it confirmed the theft, gave a number, named the kinds of partner IDs affected, and said it had reported to the regulator and the police. The next day, it gave a separate count for the most sensitive data, identity document images, and started notifying those members. For a data breach in Japan, that is fast and unusually specific. The Digital Agency, by comparison, took eleven weeks after detection to go public.

"No risk" is a strong claim for passwords#

Park24 says the passwords were stored in a non-recoverable form, so there is "no risk" that accounts will be misused through them. Hashing does protect passwords. But how well depends on the method used, and weak or common passwords can still be recovered from stolen hashes with enough effort. Park24 has not said which method it used. Users should not rely on "no risk" alone.

A Privacy Mark holder#

Times Mobility, the Park24 group company that runs Times Car, holds the Privacy Mark (プライバシーマーク), Japan's best-known certification for handling personal data. It first received the mark in 2021, and it is currently valid until August 2027.

Privacy Mark holders must report incidents to JIPDEC, which runs the scheme. On September 29, JIPDEC announced that it had received Times Mobility's report and asked the company to investigate promptly and respond appropriately. It said it would act based on the results. Under the scheme's rules, JIPDEC can issue a recommendation, suspend the mark or revoke it. As of JIPDEC's latest list, one company has had its mark revoked and none is suspended.

In a 2024 interview published by JIPDEC, Times Mobility said the mark helped win corporate customers, and that its staff understood an incident could cost the company its mark. It also said that corporate customers often still ask it to fill in a checklist on how it handles personal data before signing up. A certificate held for five years did not prevent the theft of 1.6 million identity documents. What JIPDEC does now will show what the mark is worth.

A second car rental incident the same week#

Added September 29, 2026.

On September 26, the day after Park24 detected the Times Car intrusion, Nippon Rent-A-Car (ニッポンレンタカー) announced a separate incident. According to its notice:

  • A third party gained unauthorized access to the system behind its NR app, and member information may have been viewed.
  • 41 members are affected. The information includes names, phone numbers, email addresses, login IDs, rental history and reservations.
  • For members who had registered them, driver's license details (license number, address and date of birth), the last four digits of a credit card number and the cardholder name may also have been viewed.
  • Nippon Rent-A-Car has asked the affected members to reset their passwords, reported to the Personal Information Protection Commission, and consulted the police.

Update, October 2: On October 1, Nippon Rent-A-Car disclosed a second, separate intrusion into the same app system, using a different method. It was found on September 29 while investigating the first. Between September 19 and 21, attackers accessed the member pages of 55 more members, with the same kinds of data at risk, bringing the total to 96. Nippon Rent-A-Car has reported to the Personal Information Protection Commission and consulted the police, and has emailed the affected members.

The two companies' incidents are very different in scale, and neither company has suggested any connection between them. Nippon Rent-A-Car has not said how the access happened. But two car rental services reporting unauthorized access to member data in the same week is a good reason for anyone with accounts at either to review their passwords.

Park24's Q&A: former members, compensation and license images#

Added October 8, 2026.

On October 1, Times Mobility published a Q&A on the breach, last updated on October 6. It adds these points:

  • Former members. Park24 began contacting former members individually on October 1. Because their registered contact details may no longer be valid, it asks former members to send the details they registered with through a dedicated inquiry form, and says it will reply to each in about two weeks.
  • Compensation. Park24 will decide its "overall policy" after the outside investigation is complete. It has not said whether it will compensate anyone.
  • Misuse of license images. Banks and card companies that check identity online under Japan's anti-money-laundering law do not rely on an image of a document alone, Park24 says. They add steps such as matching a selfie to the photo or confirming an account in the person's name. But it says this does not completely rule out fraudulent applications, impersonation for other kinds of contracts, or fraud that combines the leaked data with other information.
  • Scam warnings. Park24 says it consulted the National Police Agency, which warned about phone scams by people posing as police officers and pointed to free apps that block or flag calls from international numbers and numbers used in fraud. Park24 says it will never ask for SMS codes, passwords, or the PINs of driver's licenses or My Number cards.

After the breach: credit bureaus, a lawsuit and a ministry#

Added October 2, 2026. Updated October 8.

The leak of license images has had effects outside Park24:

  • Credit bureaus overwhelmed. On September 29, Japan's credit information bureaus CIC and JICC said requests were piling up from people filing self-reports (本人申告), which flag a risk of identity misuse to lenders, and asking to see their own credit records. On October 1, JICC suspended app-based fraud-prevention filings, accepting them by post for now.
  • A class action in preparation. A lawyer opened a website on September 30 to gather plaintiffs for a class action against the company. By October 2, more than 10,000 people had registered, according to Kyodo News, and more than 15,000 by that evening, according to Nikkei. The lawyer said on X that the number passed 30,000 on October 4, and TBS reported about 64,000 on October 7. The lawyer told TBS the aim is to seek "a sincere response, including an explanation and compensation". Registration only signals interest. No lawsuit has been filed.
  • The suit takes shape (added October 27). On October 23, after Park24 announced its ¥3,000 payment, the lawyer said he intends to sue, according to Kyodo News. At a press conference on October 26, counsel said more than 100,000 people had registered, according to ABEMA TIMES. The planned suit in the Tokyo District Court would name Park24, Times Mobility and two of their representative directors, and seek ¥50,000 per person whose ID images leaked, ¥30,000 for others, and actual costs such as license reissue fees. Counsel argued that keeping license images for up to seven years after customers left conflicted with the privacy law, and said registrants had reported more than 3,300 cases of misuse, including loans taken out in their names; those are the plaintiffs' figures. It had not been filed as of October 27.
  • The transport ministry steps in. In a document dated October 1, the Ministry of Land, Infrastructure, Transport and Tourism, which oversees the car rental business, asked the Japan Rental Car Association (全国レンタカー協会), whose members include car-sharing operators, to check their measures against data leaks and to report by October 30. The leak of license images "could cause anxiety among users and shake trust in the rental car business", the ministry said, according to Kyodo News.

Park24 has not said whether it will compensate people whose identity documents were taken. Its Q&A says it will decide its overall policy after the outside investigation.

Can I get a new driver's license?#

Added October 11, 2026.

In Japan, driver's licenses are issued by each prefecture's public safety commission, and a license is normally reissued only in cases such as loss or damage. Since the Times Car leak, a growing number of prefectures have agreed to reissue licenses to people who are worried that theirs was leaked. The Road Traffic Act allows a reissue when the commission "deems it appropriate", the Asahi Shimbun reported.

  • Hiroshima started accepting applications on October 1, according to the Asahi. Miyagi started around the end of September and had reissued about 30 licenses by October 8, according to Sendai Broadcasting.
  • By October 10, local TV reports covered at least 16 prefectures doing the same, including Miyagi, Niigata, Aichi, Okayama, Hiroshima and Saga, according to a compilation by the Japanese security news site Security Measures Lab. We have not seen reports of Tokyo doing so.
  • A reissued license gets a new photo and a new license number. Applicants pay the reissue fee, according to local reports.
  • Conditions and documents differ by prefecture, and the prefectures' own websites only describe the normal reissue procedure. Check with your local driver's license center before going.

The effect is limited. A new license does not change your name, address or date of birth, which have already leaked. A police official told the Asahi that a reissue is "not something that lets you feel safe". NHK reported a rush of applications at license centers alongside the same doubts.

The authorities are also acting on the other side. At a press conference on October 8, the head of the National Police Agency asked businesses that open accounts or lend money to verify identity strictly, and asked the public to use call-blocking apps and not to follow links in emails claiming to come from breached companies, according to the Asahi. On October 9, the Financial Services Agency asked banks and other financial firms to stop accepting uploaded photos of ID documents before the legal deadline of April 2027 and to switch to reading the IC chip instead. We cover that request in our article on the government's response. In our view, that change does more to blunt the misuse of leaked license images than a new license does, because a photo of the old license would no longer pass an online check.

What this means for readers#

  • If you collect identity document images for online sign-up, ask whether you need to keep them once the check is done. Times Car has decided it does not.
  • If you have ever registered with Times Car, including if you left or never finished signing up, assume your data is included. Park24 started emailing members whose identity documents were taken on September 29.
  • If your ID images were sent out, Park24 will contact you about the ¥3,000 payment. Treat any message about the payment with suspicion: scammers often copy compensation notices. Check through the Times Car website or hotline rather than links.
  • Genuine notices and fake ones will arrive at the same time. Do not follow links or open attachments in messages about this incident. Park24 says it will never ask for passwords, authentication codes or card details. Check your status through the Times Car website or its hotline (0120-25-8924) instead.
  • Change your password anywhere else you used the same one as for Times Car, including other car rental and car-sharing services. This is good practice regardless of how the passwords were stored.
  • Be suspicious of messages about Times Car, and of unexpected calls or letters that use your address, date of birth or license details. Park24 says it will never ask for passwords or card details by email, SMS or phone.
  • If you are a former member, use the dedicated inquiry form on the Times Car website to confirm whether your data is included, rather than waiting for a notice to reach an old address. Expect a reply in about two weeks.
  • Hang up on callers who say they are police and ask for money, codes or personal details. Park24 says the National Police Agency specifically warned about this kind of scam.
  • If your license image was taken and you want a new license number and photo, ask your prefecture's driver's license center whether it offers a reissue for this case. Expect a fee, and remember it does not change your name, address or date of birth.
  • Watch for signs of identity misuse, such as accounts or contracts you did not open. If you live in Japan, you can file a self-report with the credit bureaus CIC and JICC so lenders are warned, and request your credit records. Expect delays: both have been swamped since the breach.

Japanese terms at a glance#

Japanese Reading Meaning
パーク24 Pāku Nijūyon Park24 Co., Ltd., operator of Times parking and Times Car
タイムズカー（旧：タイムズカーシェア） Taimuzu Kā (formerly Taimuzu Kā Shea) Times Car, formerly Times Car Share
プライバシーマーク（Pマーク） puraibashī māku (pī māku) Privacy Mark, a Japanese certification for personal data handling
本人申告 honnin shinkoku Self-report to a credit bureau flagging possible identity misuse
運転免許証の再交付 unten menkyoshō no saikōfu Reissue of a driver's license
公安委員会 kōan iinkai Public safety commission (issues driver's licenses in each prefecture)
本人確認書類 honnin kakunin shorui Identity verification documents
運転免許証画像 unten menkyoshō gazō Driver's license image
現住所確認書類 genjūsho kakunin shorui Proof-of-address document, such as a utility bill
復元できない形式 fukugen dekinai keishiki "A form that cannot be restored" (Park24's description of password storage)
第三者に取得された daisansha ni shutoku sareta "Obtained by a third party"

We will update this article when Park24 publishes its next report, including its recurrence prevention measures.