TimesCar Data Breach Exposes Personal Information of 6.6 Million Accounts
TimesCar, a Japanese car-sharing service, has confirmed that approximately 6.6 million current and former user accounts were affected by a cyberattack revealed late last week.
The company announced the incident on September 25, saying that a third party had accessed its systems at the beginning of the month. TimesCar took steps to block the unauthorized access on September 26.
At the time, TimesCar said it was investigating whether attackers had accessed members’ personal information but confirmed that data had been stolen. In an update published on September 28, the company confirmed the scope of the breach.
TimesCar data breach affects 6.6 million accounts
The breach affected 6.6 million current and former TimesCar members, along with current and former members of the Times Business Services Corporate Accounts program.
According to the company’s update, the compromised information may include:
- Full name
- Corporate member department name
- Physical address
- Date of birth
- Telephone number
- Email address
- Driver’s license information
- Identity verification document information, including driver’s license images
- Account password
- Cooperation service ID
TimesCar said passwords are stored in a “non-recoverable format,” suggesting they are encrypted or hashed, but the company did not provide additional technical details.
No credit card information affected
TimesCar said its investigation determined that no credit card information was affected. The company also said there is currently no evidence that the stolen data has been distributed online.
TimesCar warns customers about phishing attempts
The company urged members to be cautious of emails, SMS messages and phone calls claiming to be from TimesCar. Customers should not open unexpected attachments or enter passwords or credit card details in response to suspicious messages.
TimesCar is a car rental and mobility service operated by Times Mobility, a Park24 Group company. The service had 4 million active members as of August 2026, with 84,000 vehicles available for online reservation at 29,000 stations across all 47 prefectures of Japan.
TimesCar is conducting a forensic investigation into the cause and scope of the incident with assistance from external experts. The company said it will notify affected customers individually, with notifications sent in stages.
Despite the cybersecurity incident, TimesCar said that all services continue to operate as usual.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, correct, and revalidate at machine speed.
Source: www.bleepingcomputer.com