Update, 6 October 2026, 11:00 JST. Added a TV report of Japanese licence images offered on a dark-web site for about ¥20 each. Whether they are genuine is unknown, and no link to Times Car has been established. Registrations for the planned lawsuit have passed 40,000. See "Licence images for sale on a dark-web site" below.
Update, 2 October 2026, 22:17 JST. Added what happened after the notices: the impersonation risk, a rush to credit bureaus and over 10,000 sign-ups for a planned lawsuit. Also added what leaked licence images mean for online identity checks. See "After the notices" and "Your own identity checks" below.
What is confirmed
Times Mobility, the Park24 group company that runs the Times Car car-sharing service, says a third party obtained member information from its web system. The count is about 6.6 million accounts. Second notice.
At a glance. Original graphic for this article.
The affected accounts cover four groups:
- Times Car members
- Former Times Car members, including people who applied but never completed joining
- Times Business Service members, the corporate programme
- Former Times Business Service members
The notice lists these items, and says they vary by person:
- Name, address, date of birth, phone number, email address
- Department name, for corporate members
- Driving licence information
- Identity document information, such as licence images
- Password, stored in a form the company says cannot be restored
- Linked service IDs, such as JR West's WESTER ID
Identity documents leaked for about 1.6 million accounts. The third notice names four kinds: driving licence images, proof-of-address images such as utility bills, student ID images, and family verification documents.
Credit card information is not involved. The company's FAQ says it does not hold card data. As of the notices, it had found no publication or misuse of the data.
| Date (JST) | Event | Source |
|---|---|---|
| 1 Oct | FAQ published. Notices to former members begin. | FAQ |
| 29 Sep | Third notice: identity documents leaked for about 1.6 million accounts. Email notices to those members begin. JR West publishes a follow-up. | Third notice, JR West |
| 28 Sep | Second notice: data theft confirmed, about 6.6 million accounts. Reported to the Personal Information Protection Commission and the police. | Second notice |
| 26 Sep, 07:25 | Access route blocked, traffic from the attack source cut, and the block verified. | Second notice |
| 25 Sep, 09:07 | Unauthorised access to the Times Car web system detected. First notice published the same day. | First notice |
Figure 1. The disclosure timeline. Original graphic for this article.
JR West says its own systems were not accessed and that WESTER passwords are held by JR West, so they are not part of this leak. It still advises changing any password reused on other services. JR West follow-up.
How to read the numbers
Figure 2. Accounts affected, and the share with identity documents. Original graphic for this article.
Do not read “6.6 million accounts” as “6.6 million current customers.” The figure includes former members and people whose applications were never completed. BleepingComputer cites about 4 million active members as of August 2026, a figure this article has not checked against a company source.
The 1.6 million figure counts accounts, not documents or people. One account can hold several images: a licence, a proof of address, and a student or family document.
Detection time is not the start of the access. The notices say when the access was detected and when it was blocked, about 22 hours apart. They do not say when it began. BleepingComputer reports access “at the beginning of the month”; the notices reviewed here do not state that.
“Cannot be restored” is the company's description of its password storage. The notices do not name the method. Editorial assessment: a password that cannot be reversed can still be guessed offline if it is weak, so JR West's advice on reused passwords is sound.
The linked service ID count is unclear. The notice says WESTER ID and others, “9 in total”. It does not say whether that means nine services or nine records.
After the notices: impersonation risk and a lawsuit
Times Mobility has published nothing new since the third notice of 29 September, updated on 1 October. The developments below come from news reports, not from the company.
The risk now being discussed is impersonation. Kyodo News reports the concern that the leaked licence images could let a third party pose as a member to open a bank account or get a credit card. Kyodo News. No misuse has been reported. The company's notices said none had been found.
People turned to the credit bureaus. In Japan, a person can add a self-declaration (本人申告) to their credit file, for example after a licence is lost or its image leaks. It asks lenders to take extra care when checking an application. Requests piled up at the CIC and JICC credit bureaus. On 1 October JICC paused smartphone applications for this service and for credit file disclosure. ITmedia, 30 September; ITmedia, 1 October.
A group lawsuit is being organised. A lawyer opened a website to gather members for a damages claim against the operator. No claim had been filed at the time of this update. The site is still recruiting.
| When (JST) | What | Source |
|---|---|---|
| 5 Oct, 14:00 | Over 40,000 people registered on the lawsuit-preparation site | Kyodo News, via Niigata Nippo |
| 3 Oct | Nippon TV reports Japanese licence images offered on a dark-web site; no link to Times Car established | Nippon TV |
| 2 Oct, 13:00 | Over 10,000 people registered on the lawsuit-preparation site | Kyodo News, NHK |
| 1 Oct, 18:00 | Over 2,000 registered on the first day | Bengo4.com |
| 1 Oct | JICC pauses smartphone applications for self-declarations and credit file disclosure | ITmedia |
| 30 Sep | CIC and JICC report delays as requests pile up | ITmedia |
Editorial assessment. Within four days of the second notice, the problem moved from data that was exposed to an identity that can be reused. A password can be changed. A licence image cannot be recalled, so the only control left to the people affected was a flag on their credit file. Legal pressure arrived just as fast: ten thousand sign-ups came before any forensic findings. The FAQ says licence images were kept for seven years to counter impersonation. That reason will now be weighed against the impersonation risk the leak itself created.
Licence images for sale on a dark-web site
On 3 October, Nippon TV's programme 追跡取材 news LOG looked at how leaked identity documents are traded. Nippon TV (Japanese).
- The source. S2W, a company that analyses dark-web sites, told Nippon TV that licence images and similar documents leaked through unauthorised access are sometimes bought and sold there.
- The listing. Nippon TV visited a Chinese-language site. An earlier post on it showed rows of driver's licence images and was labelled "1,000 Japanese driver's licences", priced at US$122. That is about ¥20,000, or roughly ¥20 per image. Payment was in cryptocurrency.
- Genuine or forged: unknown. Nippon TV said it could not tell whether the images were real or forged.
- Other documents. The same site appeared to offer images of health insurance cards and My Number cards.
- No link to Times Car. Nippon TV did not say the images came from Times Car, and gave no date for the post. Times Mobility has published nothing new since its third notice and has reported no misuse. Times Car news page (Japanese).
This is not the first such listing. In April 2026, the Japanese site Security Measures Lab (セキュリティ対策Lab) reported a hacker-forum post claiming over 20,000 Japanese licence records. It could not identify where they came from. Security Measures Lab (Japanese).
Editorial assessment. Read this report as a price signal, not as evidence about this breach.
- A licence image is a cheap commodity. At around ¥20 each, keeping one secret is not a realistic defence. The defence is a check that an image cannot pass, such as reading the IC chip (see "Your own identity checks" below).
- "Is my licence on the dark web?" is a lure in itself. Expect messages offering to check, or to remove your data, that ask you to upload your licence or pay. Do not visit such sites or buy listings to check. Doing so can expose you, may be illegal, and proves nothing.
- For fraud teams, reuse is the signal. A stolen or forged image tends to be submitted more than once. Compare new identity-document uploads against ones you have already received, by licence number and by image similarity. Flag the same licence used with different contact details, phone numbers or bank accounts.
- Members whose images leaked can still act. The practical options are the same as before: a self-declaration on their credit file, watching for unexpected accounts, contracts or credit checks, and asking at a licence centre about reissue.
What changes in the security review
Three separate reviews follow from this incident. The first is for any organisation that collects identity documents. The second is for any company whose staff drive on a Times Business Service account. The third is for any organisation that checks identity online.
Identity documents that outlive the relationship
The company's FAQ explains why former members' data was still there. Name, address and date of birth are kept for seven years under tax and other law. Licence information and licence images are kept for seven years to counter impersonation and to answer enquiries.
Editorial assessment: those are two different kinds of reason. The first is a legal duty. The second is an operational choice, and it covers the most sensitive records in the leak. A licence image shows a face, an address and a licence number together, and the holder cannot change it the way a password is changed.
The review for your own organisation has four questions:
- Where are identity document images stored: customer onboarding, staff onboarding, visitor registration, supplier checks?
- Does each store have a written retention basis, and is it a legal duty or a convenience?
- Could you keep the result of the check, such as the date and the outcome, and delete the image?
- Are records from abandoned applications deleted, or do they stay with the rest?
The notices do not say how the images were stored or whether they sat in the same system as the account data. Do not assume either way. The useful question for your own systems is whether the web application that takes the upload can also read back every image ever uploaded.
A staff list inside a supplier's breach
The corporate programme is in scope, including former corporate members. For those accounts the leaked items include the employee's name and department name, alongside contact details and licence information.
Editorial assessment: that is enough to write a convincing message to a named employee about a real service they use for work. The company's own notice warns of fake emails, SMS and phone calls in its name. For a corporate account, the same lure can also pose as your own fleet or general affairs team.
If your company uses, or has used, Times Business Service:
- Confirm whether a contract exists now or existed in the past. The FAQ describes seven-year retention for former members; it does not say whether corporate records follow the same period.
- Ask Times Mobility which of your accounts are affected and which data items each one holds.
- Tell those employees directly, through a channel they already trust, what a real notice looks like.
- Remember that SMS and phone calls bypass your mail gateway. Awareness is the only control there.
- Check whether staff registered personal email addresses or phone numbers. Those are outside your monitoring.
The company says it will contact affected people individually. That contact goes to the address on the account, which may not be an address your organisation controls.
Two additions since the notices. Tell affected employees that a credit bureau self-declaration exists, and that applications are delayed. Also warn them that lures may now ride on the follow-up news. Editorial assessment: fake lawsuit sign-ups, fake compensation offers and fake credit bureau pages are the obvious next themes.
Your own identity checks
Figure 3. Which online identity checks a leaked licence image can still pass. Original graphic for this article.
About 1.6 million accounts' worth of identity document images are now outside the company. Any service that verifies people by asking for a photo of their licence should assume some of those images will be tried.
Japan is already retiring that method for regulated services:
- Financial and other regulated accounts. A rule change under the Act on Prevention of Transfer of Criminal Proceeds, promulgated on 24 June 2025, abolishes the online method based on a photo of an identity document and a photo of the face. The National Police Agency gives the reason as the risk of impersonation with forged or altered documents. NPA Q&A (Japanese). Industry guidance gives 1 April 2027 as the effective date. DNP (Japanese).
- Mobile phone contracts. Operators stopped accepting uploaded photos of identity documents from 1 April 2026 under the mobile phone fraud prevention law. IIJ notice, as an example (Japanese).
Unregulated services are not bound by these deadlines, but they face the same leaked images. That includes rentals and sharing services, marketplaces, buyback shops, membership sign-ups and recruitment. Four questions for your own onboarding:
- Which of your sign-up or change-of-details flows accept a photo of an identity document?
- Can they read the IC chip instead, or use the My Number card's electronic certificate?
- Until they can, what else stands behind the photo? For example, matching against other data you hold, limits on new accounts, and manual review before high-value actions.
- After the check, do you keep the image? If you do, you are building the same store that leaked here.
Which teams should act
| Team | Practical next step |
|---|---|
| Third-party risk | Find any current or past Times Business Service contract. Ask the supplier for the affected accounts and data items. List other suppliers that hold identity documents for your staff. |
| Legal / privacy | Map the affected employees and data categories. Have counsel assess any duty toward those employees, and tell them about credit bureau self-declarations. Review your own retention schedule for identity document images: a group claim formed here within days of the notice. |
| Email security | Review inbound mail since 25 September that uses the Times Car, Park24 or WESTER names. Tighten impersonation rules for those brands. Watch for lawsuit, compensation and credit bureau themes. |
| SIEM / SOC | Run the mail hunt below. Watch for credential entry or attachment opens by the affected staff. Do not expect supplier IOCs. |
| IT operations | Inventory your own systems that store identity document images. Check retention, deletion of abandoned applications, and who can read images back. List onboarding flows that accept an ID photo, and plan a move to IC chip or electronic certificate checks. |
| EDR | Cover the follow-on risk: payloads delivered by a lure. A clean endpoint says nothing about a supplier's web system. |
IOCs and hunting
The notices reviewed contain no attacker IP, domain, hash or technique. There are therefore no incident IOCs in this article, and none should be inferred.
What a company can hunt for is the follow-on: mail that uses the Times Car or Park24 names but does not come from their domains. The query below is illustrative. It was not run against live data.
// Illustrative. Microsoft Defender XDR advanced hunting, EmailEvents table.
// In Microsoft Sentinel, replace Timestamp with TimeGenerated.
// The domain list is an assumption taken from the company's public websites.
// Confirm the real sending domains with the supplier before relying on it.
let official = dynamic(["timescar.jp", "park24.co.jp", "timesmobi.co.jp"]);
EmailEvents
| where Timestamp >= datetime(2026-09-25)
| where EmailDirection == "Inbound"
| where Subject contains "タイムズカー" or Subject contains "パーク24"
or Subject contains "Times Car"
or SenderDisplayName contains "タイムズ" or SenderDisplayName contains "パーク24"
or SenderDisplayName contains "Times Car"
| extend SenderDomain = tolower(SenderFromDomain)
| where not(SenderDomain in (official))
and not(SenderDomain endswith ".timescar.jp")
and not(SenderDomain endswith ".park24.co.jp")
and not(SenderDomain endswith ".timesmobi.co.jp")
| project Timestamp, SenderFromAddress, SenderDisplayName, Subject,
RecipientEmailAddress, DeliveryAction, ThreatTypes
Read the results with three limits in mind:
- A genuine notice may be sent through a mail service on another domain. A hit is a lead, not a verdict.
- Newsletters and news alerts that mention the breach will match. Exclude them after you have looked at them.
- SMS, phone calls and mail to personal addresses never reach this table.
To catch lures that ride on the follow-up news, add terms such as 集団訴訟 (group lawsuit), 補償 (compensation) and 本人申告 (credit bureau self-declaration) to the subject filter. Expect even more news matches.
No equivalent endpoint query is offered. The disclosed event happened on a supplier's web system, where your EDR has no sensor.
What remains unknown
The company says a forensic investigation by outside specialists is under way. As of the cut-off below, the notices leave these points open:
- Entry point and cause. The notices say an access route was blocked. They do not describe it.
- Start of the access. Only the detection and containment times are given.
- How the data was stored. Whether document images shared a system with account data is not stated.
- Per-person detail. The company says it will tell affected members what leaked for them in about two weeks from 29 September.
- Corporate accounts. No separate count or guidance for corporate members has been published.
- Compensation. The FAQ says the policy will follow the investigation.
- Prevention measures. The second notice says completed and planned measures will be published in a later update.
- Misuse. The notices report none. The impersonation risk in the news reports is a risk, not confirmed cases.
- Whether any Times Car images are on sale. Neither the company nor the Nippon TV report has said so. The listing Nippon TV showed has no established source.
- The lawsuit. Over 40,000 had registered by 5 October. Registering on a website is not filing a claim. Who will sue, in which court and for what is not yet known.
Revisit this article when the next notice appears. Any of these answers could change the assessment above.
Reporting note
First published from information up to 2 October 2026, 03:22 UTC / 12:22 JST. Updated with information up to 2 October 2026, 13:17 UTC / 22:17 JST, and again up to 6 October 2026, 02:00 UTC / 11:00 JST. Figures come from the notices by Times Mobility and Park24 and from the company's FAQ. piyolog's summary was used to cross-check the sequence of notices. BleepingComputer is cited only where its account differs from, or adds to, the notices.
The update adds developments reported by Kyodo News, NHK, Bengo4.com and ITmedia. These are news reports, not company statements. Times Mobility's news page showed no notice after the third notice when checked. Registration counts are as of the times the reports give and will keep changing. The 6 October update adds the Nippon TV report and Kyodo's 40,000 figure. Nippon TV's description of the listing is reported, not verified by SecOpsNomad: this site does not visit or buy from dark-web markets.
This is independent editorial analysis of public statements. It is not an investigation conducted by SecOpsNomad, and it makes no claim about how the access happened.
Sources
- Park24, first notice, 25 September 2026 (updated 26 September)
- Times Mobility, second notice, 28 September 2026 (updated 1 October)
- Times Mobility, third notice, 29 September 2026 (updated 1 October)
- Park24, third notice, 29 September 2026
- Times Car FAQ on the incident, published 1 October 2026
- JR West, WESTER follow-up notice, 29 September 2026
- piyolog, summary of the Times Car incident, 28 September 2026 (updated 30 September)
- BleepingComputer, 28 September 2026
- Kyodo News, impersonation risk and lawsuit, 2 October 2026 (Japanese)
- Kyodo News, over 10,000 registered, 2 October 2026 (Japanese)
- NHK, over 10,000 registered, 2 October 2026 (Japanese)
- Nippon TV, licence images traded on dark-web sites, broadcast 3 October 2026, updated online 5 October (Japanese)
- Kyodo News via Niigata Nippo, over 40,000 registered, 5 October 2026 (Japanese)
- Security Measures Lab, Times Car analysis citing its April 2026 finding of a Japanese licence listing (Japanese)
- Bengo4.com, over 2,000 on the first day, 1 October 2026 (Japanese)
- ITmedia, delays at CIC and JICC, 30 September 2026 (Japanese)
- ITmedia, JICC pauses app applications, 1 October 2026 (Japanese)
- National Police Agency, Q&A on the 2025 rule change abolishing high-risk verification methods (Japanese)
- DNP, identity verification changes in April 2027 (Japanese)
- IIJ, identity verification changes from 1 April 2026 (Japanese)