Times Car confirms data breach affecting 6.6 million user accounts
Times Car confirms 6.6 million user accounts compromised in cyberattack.
Summary
Japanese car-sharing service Times Car has confirmed a data breach affecting approximately 6.6 million user accounts, including current and former members, as well as corporate account holders. The incident, which occurred at the beginning of September, resulted in unauthorized access to personal information such as names, addresses, dates of birth, contact details, driver's license information, and encrypted passwords. While credit card information was not compromised, the company is urging users to be vigilant against phishing attempts.
Full text
Times Car confirms data breach affecting 6.6 million user accounts By Bill Toulas September 28, 2026 04:31 PM 0 Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week. The company announced the incident on September 25, saying that a third party had accessed its systems at the beginning of the month. Times Car took action to block the unauthorized access on September 26. At the time, the company said it was investigating whether the attackers accessed members' personal information, but confirmed the data theft in an update earlier today. The company says that the intrusion affects 6.6 million current and former Times Car members, and also current and former members of the Times Business Service corporate account program. According to the update, exposed information includes the following data: Full name Department name for corporate members Physical address Date of birth Telephone number Email address Driver’s license information Identity verification document information, such as images of driver’s licenses Account password Linked service IDs The company said that passwords were stored in “a form that cannot be restored,” suggesting they were encrypted or hashed, although it did not provide additional details. The investigation confirmed that credit card information remained unaffected. Currently, there is no evidence that the stolen data has been distributed online. Times Car is a major vehicle rental and mobility service operated by Times Mobility, part of the Park24 Group. It’s a large business with a claimed 4 million active members as of August 2026, allowing online reservations for 84,000 vehicles and collecting them from one of the 29,000 stations it operates across all 47 Japanese prefectures. The company urged members to be cautious about emails, SMS, and phone calls claiming to come from Times Car, and to avoid opening attachments or typing passwords and credit card details. The firm is now conducting a forensic investigation into the cause and scope of the incident with the help of an external expert. Times Car said it would notify affected customers individually, but the notifications would be sent in stages. Despite the cybersecurity incident, the company assured that all its services continue to operate as normal. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat Related Articles: Sakura Internet hack exposes data of up to 1.36 million accountsBigCommerce alerts merchants of data breach linked to Ribon appsGyazo server flaw exploited to steal 23.6 million user recordsCenterPoint Energy confirms customer data stolen in cyberattackJapan's Digital Agency says VPN flaw exposed 246,000 personnel records