The finding
A web vulnerability at Times Car became a route into a much larger store of customer information. In its October 23 update, parent company Park24 said the intruder entered the web system, explored it, and used information obtained there to reach database and file-storage areas. The company has withheld technical details of the flaw while it investigates, so the account establishes a failure path but not a reproducible exploit or named vulnerability.
Park24 puts the affected population at 6,628,007 records. The scope crossed normal customer boundaries: current members, former members, people who began but did not complete registration, and current or former users of the business service were included. Times Car's vehicle-reservation service continued operating, making this a confidentiality failure rather than an availability incident.
What the system kept
The exposed fields varied by person but could include names, addresses, dates of birth, phone numbers, email addresses, driver's-license details, identity-document information or images, linked-service identifiers, and passwords stored in a form Park24 described as non-restorable. The company said full payment-card numbers and security codes were not held in the affected system.
The identity images are the most consequential part of the disclosure. Park24 says some encrypted driver's-license or other identity-document images showed traces of access and external transmission. Those traces do not prove an attacker could immediately read the images, but the company says future decryption cannot be ruled out. As of October 23, Park24 said it had not confirmed publication, sale, or secondary misuse of the data.
A month from detection to a retention reversal
Park24 detected the unauthorized access at 9:07 a.m. on September 25. By 7:25 a.m. the next day, it said it had blocked the confirmed route and attacker communications. The September 28 disclosure established the roughly 6.6 million-account scale; the October 23 update added the attack path, identity-image risk, compensation, and longer-term response.
Customers whose encrypted identity-document images showed both access and external-transmission traces are being offered ¥3,000 in cash or gift value. More important than the payment, Park24 says it will delete currently retained identity-document images and stop keeping such images after registration checks are complete. Reuters reported that Park24 expects about ¥5.5 billion in extraordinary losses from response and compensation costs.
The lesson: verification does not justify indefinite storage
An identity document may be necessary to complete an eligibility check; it does not follow that a copy must remain attached to the account forever. Every retained image extends the period in which one compromised application can create identity-fraud risk. Former customers and abandoned registrations are especially revealing: they add little current value while preserving nearly the same breach consequence.
A safer design separates proving an attribute from retaining the evidence used to prove it. Where law and operations permit, a system can record that a verification succeeded, when it happened, and which approved process performed it, then delete the underlying image on a short, enforced schedule. If an image must be retained, encryption should be paired with segmented storage, separately governed keys, narrow service access, audit alerts, and automatic expiration.
Compensation recognizes that affected people now carry a monitoring burden, but money cannot revoke a driver's license image the way a password can be reset. Park24's deletion decision is therefore more than cleanup: it is an admission that prevention includes deciding what a system should no longer possess.
What to watch next
An external investigation committee is examining the incident, and Park24 says it will announce additional security and governance measures. The unresolved questions are material: the company has not named the vulnerability, said when the attacker first entered, quantified the identity-image subset, or established whether any encrypted files became readable. Until that work is complete, the responsible conclusion is that a large, sensitive repository was reached—not that every exposed document has already been used.
What remains uncertain
Park24 has not disclosed the specific vulnerability or a CVE, the attacker's identity, the intrusion's initial date, or the exact number of identity-document images accessed or transmitted. It has not confirmed that encrypted images were decrypted, sold, published, or misused. The reported ¥5.5 billion extraordinary loss is an estimate and may change as investigation and response continue.
Sources & method
AI-assisted research and drafting, reviewed by the editor before publication. Reporting is attributed to the sources below; this is not an independent forensic investigation.
- Notice and apology regarding unauthorized access to Times Car systems (update) · Original source · 2026-10-23
- Notice and apology regarding unauthorized access to Times Car systems · Original source · 2026-09-28
- Japan companies compensate users as cyberattacks buffet economy · Reporting · 2026-10-26
- Times Car confirms data breach affecting 6.6 million user accounts · Reporting · 2026-09-28