Reported by 2 outlets
Times Car confirms data breach affecting 6.6 million user accounts
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.04 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Times Car, the Japanese car-sharing service operated by Times Mobility under the Park24 Group, confirmed that roughly 6.6 million current and former member accounts were compromised. A third party accessed its systems at the beginning of September; the company blocked the unauthorized access on September 26 and announced the incident on September 25, confirming the data theft in a September 30 update. The exposure also covers current and former members of the Times Business Service corporate program.
The stolen data is unusually complete: full name, physical address, date of birth, phone, email, department for corporate members, driver's license information including images of identity documents, account passwords, and linked service IDs. Passwords were stored in what the company called "a form that cannot be restored," suggesting hashing or encryption, and credit card data was unaffected. No evidence yet shows the data circulating online.
Identity-document images plus passwords make this a strong kit for follow-on account takeover and fraud in Japan, so watch for phishing that references Times Car membership and for the dataset surfacing on leak forums. The gap between initial access in early September and containment on September 26 is also a reminder of how long attackers can sit inside consumer platforms before detection.
Timeline
-
original reporting
Times Car confirms data breach affecting 6.6 million user accounts
bleepingcomputer.com · 15d ago · September 28th, 2026
Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week. The company announced the incident on September 25, saying that a third party had accessed its systems at the beginning of the month. Times Car took action to block the unauthorized access on September 26. At the time, the company said it was investigating whether the attackers accessed members' personal information, but confirmed the data theft in an update earlier today . The company says that the intrusion affects 6.6 million current and former Times Car members, and also current and former members of the Times Business Service corporate account program. According to the update, exposed information includes the following data: Full name Department name for corporate members Physical address Date of birth Telephone number Email address Driver’s license information Identity verification document information, such as images of driver’s licenses Account password Linked service IDs The company said that passwords were stored in “a form that cannot be restored,” suggesting they were encrypted or hashed, although it did not provide additional details. The investigation confirmed that credit card information remained unaffected. Currently, there is no evidence that the stolen data has been distributed online. Times Car is a major vehicle rental and mobility service operated by Times Mobility, part of the Park24 Group. It’s a
-
update from park24.co.jp
Park24 first report: possible personal information leak from unauthorized access to the Times Car website (Report 1)
park24.co.jp · 18d ago · September 25th, 2026
Park24's first public statement on the incident, published September 25, 2026 at 20:30 JST per the company RSS feed. It says unauthorized access to the Times Car web system was detected at 09:07 JST that day, and per a September 26 addendum the intrusion path was severed and attack-source communications blocked, with post-block inaccessibility confirmed, by 07:25 JST. The notice already listed the potentially leaked categories (name, address, date of birth, phone, email, member number, license information, identity verification documents, corporate member data, linked service IDs), reported the matter to Japan's Personal Information Protection Commission, and warned members to expect impersonation phishing, with a 24-hour hotline at 0120-25-8924.
-
update from park24.co.jp
Park24 second report: investigation results and response for unauthorized access to the Times Car web system (Report 2)
park24.co.jp · 16d ago · September 28th, 2026
Park24's second report, published September 28, 2026 at 13:30 JST per the company RSS feed, roughly 16 hours before the BleepingComputer story. It confirms data stored on the breached system was obtained by a third party for about 6.6 million accounts, a figure that includes current and former Times Car members, Times Business Service corporate members, and people whose enrollment never completed. Park24 reported to the Personal Information Protection Commission and police, is running forensics with an external specialist, and said individual notifications would follow.
-
update from www.bleepingcomputer.com
🤖 Times Car (Japan, Park24 Group) confirmed ~6.6M current/former accounts breached: names, addresses, DOB, phones, emails, driver's licence
www.bleepingcomputer.com · 15d ago · September 29th, 2026
🤖 Times Car (Japan, Park24 Group) confirmed ~6.6M current/former accounts breached: names, addresses, DOB, phones, emails, driver's licence
via Mastodon https://www.bleepingcomputer.com/news/security/times-car-confirms-data-breach-affecting-66-million-user-accounts/
-
mentioned by www.bleepingcomputer.com
# TimesCar confirms # DataBreach affecting 6.6 million user accounts https://www. bleepingcomputer.com/news/secu rity/times-car-confirms-dat
www.bleepingcomputer.com · 13d ago · September 30th, 2026