A data breach at Japanese car-sharing service Times Car has exposed information tied to roughly 6.6 million accounts. The incident is notable because it involves images of identity documents, which are harder to replace than a password.
What happened
According to The Japan Times, the service’s operator announced that the breach led to the leak of information linked to 6.6 million accounts, including images of personal IDs. The paper described this as a particularly rare type of breach. The company said it first detected the problem on a Friday morning and blocked the access route the next morning.
SC World, citing Bleeping Computer, reports that the company announced the incident on September 25, saying a third party had accessed its systems at the beginning of the month, and that access was blocked on September 26. That suggests the intruder may have had access for weeks before detection. Privacy Guides’ weekly roundup also says the attacker had access for nearly a month. Reports differ slightly on dates and wording, and the company’s full forensic findings have not been published in the sources reviewed.
What was exposed
The affected people are current and former Times Car members, plus members of the Times Business Service corporate programme. The data reportedly includes:
- full names and, for corporate members, department names
- physical addresses, dates of birth, phone numbers and email addresses
- driver’s licence information and identity-verification document details
- account passwords and linked service IDs
The Japan Times reports that 1.6 million documents were accessed, including images used to verify identity, and that no credit card information was taken. Japan Today, citing Park24, the parent company, says 1.6 million of the affected accounts involved leaked driver’s licence images. The company has said it has not detected any misuse of the data so far.
Legal fallout
Japan Today reports that a lawyer, Yuki Makino, has helped launch a website for people considering a compensation lawsuit. Thousands have reportedly signed up. Whether such a case will proceed is not yet known.
Why ID images matter
A leaked password can be changed in minutes. A licence photo, together with a name, address and date of birth, can be used to impersonate someone, to make convincing phishing messages, or to try to pass identity checks elsewhere. The risk does not expire quickly, even if no misuse has been detected yet.
Practical advice for readers
- Change your password now if you have a Times Car account, and change it anywhere else you reused it. Use a unique password for each service and a password manager.
- Turn on two-factor authentication wherever it is offered, preferably with an authenticator app rather than SMS.
- Be wary of unexpected messages. Scammers often send fake “security notices” after a breach. Do not click links or call numbers in a message; go to the company’s official site or app yourself.
- Treat requests for codes or ID photos with suspicion. A genuine company will not ask for your password or a one-time code by email or text.
- Watch your accounts. Check bank statements, and any credit or identity-monitoring services available in your country, for activity you did not authorise.
- Follow official guidance. If you are notified that you were affected, read the company’s notice and use the contact channels it provides. Consider asking the relevant authorities how to report a compromised licence.
- Limit what you upload. Where you can, share ID documents only with services that need them, and ask how long they keep copies.
A wider pattern
The Times Car case came in a busy week for breach disclosures. Privacy Guides’ roundup for 25 September to 1 October also lists a reported Pentagon incident involving the Defense Manpower Data Center, and a TechCrunch report that, according to security firm UpGuard, about 16,000 databases on the Supabase platform were exposing data such as names, addresses, phone numbers and passwords. Those are separate incidents, and the details come from the reports cited.
For customers of any service that holds identity documents, the lesson is consistent: assume that data held by others can leak, and keep your own accounts hardened so a single breach does less harm.