Key takeaways

  • Park24 (パーク24), which runs Times Car (タイムズカー), Japan's largest car-sharing service, confirmed on September 28, 2026 that attackers took member data from its Times Car web system.
  • About 6.6 million accounts are affected. They include former members and people who applied but never completed sign-up.
  • The stolen data includes names, addresses, dates of birth, phone numbers, email addresses, driver's license details and images of identity documents such as driver's licenses, and passwords stored in what Park24 calls a non-recoverable form.
  • Credit card data was not taken, according to Park24. It has seen no sign so far that the data has been published or misused. Car-sharing services are running normally.

What happened#

According to Park24's two reports:

Date and time (JST) Event
Sep 25, 09:07 Park24 detects unauthorized access to its systems and starts investigating
Sep 25 First report: personal data of Times Car members may have leaked
Sep 26, 07:25 Entry path cut off, and communication with the attacker blocked and confirmed
Sep 28 Second report: investigation confirms member data was taken; about 6.6 million accounts affected

Park24 is working with outside forensic investigators and has reported the incident to the Personal Information Protection Commission and the police. It says it will contact affected people individually, and will publish its measures to prevent a recurrence in a later report.

What was taken#

Who is affected

  • Times Car members and former members, including people who applied but did not complete membership for some reason
  • Members and former members of Times Business Service, the corporate version of the service

What data was taken (varies by person)

Data Notes
Name, address, date of birth, phone number, email address
Department name Corporate members
Driver's license information
Identity document information Including driver's license images
Password Stored in "a form that cannot be restored", according to Park24
Linked service IDs IDs for nine partner services, such as JR West's WESTER ID

What was not taken, according to Park24: credit card information.

Times Car requires a Japanese driver's license. Its FAQ says foreign and international driving permits are not accepted for sign-up. So the affected people are those who hold a Japanese license, including foreign residents of Japan.

What we don't know yet#

Park24 has not said:

  • How the attackers got in, or how long they had access before detection on September 25
  • Whether this is a ransomware or extortion case. As of September 28, we have not seen Park24 or Times Car on ransomware leak sites tracked by ransomware.live
  • How the passwords were stored, beyond "non-recoverable"
  • Why data on people who never completed sign-up was still held, and for how long former members' data is kept

Our analysis#

License images cannot be changed#

A leaked password can be changed. A leaked driver's license image cannot be undone. It contains a name, address, date of birth, photo and license number in one document, which is exactly what is needed to impersonate someone. That can mean opening accounts or signing contracts with services that still accept an uploaded photo of an ID as proof of identity. For 6.6 million accounts, the long-term risk is identity misuse, not just phishing.

Why keep data on people who left or never joined?#

The affected accounts include former members and people who never finished signing up. Japan's Act on the Protection of Personal Information asks businesses to make efforts to delete personal data without delay once it is no longer needed. There may be legitimate reasons to keep some records for a period, such as dealing with traffic violations or disputes after a rental. But identity document images of people who never became customers are hard to justify. This breach is a reminder that data you no longer hold cannot be stolen.

Fast, specific disclosure#

Park24 published its first report the same day it detected the access. It said plainly that data "may have" leaked, and listed the kinds of data involved. Three days later, it confirmed the theft, gave a number, named the kinds of partner IDs affected, and said it had reported to the regulator and the police. For a data breach in Japan, that is fast and unusually specific. The Digital Agency, by comparison, took eleven weeks after detection to go public.

"No risk" is a strong claim for passwords#

Park24 says the passwords were stored in a non-recoverable form, so there is "no risk" that accounts will be misused through them. Hashing does protect passwords. But how well depends on the method used, and weak or common passwords can still be recovered from stolen hashes with enough effort. Park24 has not said which method it used. Users should not rely on "no risk" alone.

What this means for readers#

  • If you have ever registered with Times Car, including if you left or never finished signing up, assume your data is included. Watch for a personal notice from Park24.
  • Change your password anywhere else you used the same one as for Times Car. This is good practice regardless of how the passwords were stored.
  • Be suspicious of messages about Times Car, and of unexpected calls or letters that use your address, date of birth or license details. Park24 says it will never ask for passwords or card details by email, SMS or phone.
  • Watch for signs of identity misuse, such as accounts or contracts you did not open.

Japanese terms at a glance#

Japanese Reading Meaning
パーク24 Pāku Nijūyon Park24 Co., Ltd., operator of Times parking and Times Car
タイムズカー（旧：タイムズカーシェア） Taimuzu Kā (formerly Taimuzu Kā Shea) Times Car, formerly Times Car Share
本人確認書類 honnin kakunin shorui Identity verification documents
運転免許証画像 unten menkyoshō gazō Driver's license image
復元できない形式 fukugen dekinai keishiki "A form that cannot be restored" (Park24's description of password storage)
第三者に取得された daisansha ni shutoku sareta "Obtained by a third party"

We will update this article when Park24 publishes its next report.