Times Car

Times Mobility, the Park24 subsidiary operating Times Car, detected unauthorized access at about 9:10 on 25 September, after an intruder had been in the systems earlier that month. The access route was blocked by about 7:30 the following morning.

Park24 confirmed the scope on 28 September: approximately 6.6 million current and former member accounts, covering both consumer accounts and corporate Times Business Service accounts, plus IDs linked to nine external partner services. The incident was reported to Japan's Personal Information Protection Commission and to police.

Full names, department names for corporate members, physical addresses, dates of birth, phone numbers, email addresses, driver's licence information, identity verification document images, account passwords and linked service IDs.

Identity documents including licence images leaked from about 1.6 million of those accounts. That subset is the serious part. A password is a credential you replace in a minute. A photograph of a licence is a reusable identity document, and this is the third entry in this series after IDScan and the Florida DAVID database where the stolen item is the document itself rather than a number representing it.

Car-sharing members who uploaded a licence to prove they could drive, which is a requirement of the service rather than an optional extra. Corporate members are identified with their department, so the leak also maps employees to employers.

The linked service IDs extend the damage past Park24. Nine external partner services, including JR West group member services, connect to these accounts, so credential reuse and account linking carry the exposure into systems the attacker never touched.

Collecting a licence image is how a car-sharing service verifies that a member may legally drive. The requirement is reasonable and regulators would expect it. Detection and containment were also genuinely fast here: unauthorized access spotted on the morning of 25 September and the route closed by the following morning.

The gap is between verifying a licence and storing the photograph of it indefinitely. Verification needs the image for as long as it takes a human or a system to approve the member. Nothing in the service requires keeping it for the life of the account.

Which accounts still carried an identity document. The headline figure was 6.6 million accounts, and the licence images turned out to sit in about 1.6 million of them, roughly a quarter.

That ratio is the shape of a retention policy nobody had enforced. Some images had been removed, through deletion or account changes, and some had not, and the difference between those groups was established after the breach rather than before it.

A company that could state on 25 September how many accounts still held a licence photograph would have been able to notify that group immediately and precisely. Instead the distinction between a password reset and an unchangeable identity document exposure had to be worked out under investigation.

No group has claimed it and no attribution appears in public reporting. Park24 is running a forensic investigation with outside specialists alongside the police report.

The useful detail is the timeline rather than the actor. The intruder was in the systems earlier in September and was detected on the 25th, so the dwell time is measured in weeks, not the hours it took to contain once noticed.

Deleting the licence image after verification. The approval decision and a dated record of it carry the compliance value. The photograph carries the liability, and 1.6 million of them were still there years after the approvals they supported.

Second, knowing which accounts held one. An inventory of where identity documents sat would have made the 1.6 million figure available on day one, and would probably have prompted somebody to ask why the number was that high in the first place.