[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkDn6I-ELpVHj69xhsZunotFQCBpz-JV97_5PEUtTrKw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50},"15008ec7-e245-41e6-a597-13c5c9269d50","66m-accounts-exposed-in-times-car-data-breach-including-drivers-license-images","79e80b7a-eb7a-489d-bfd8-ad77698de56c","6.6M Accounts Exposed in Times Car Data Breach Including Driver's License Images","Times Mobility suffered a major data breach exposing personal and identity records for approximately 6.6 million users, including highly sensitive driver's license images for 1.6 million accounts. The exposure of government-issued identity documents represents a severe risk, as this data can enable identity theft, fraud, and account takeover attacks that are difficult for victims to reverse. Organizations that collect and store sensitive identity verification documents must apply proportionally stronger security controls, including encryption at rest and strict access limitations. This incident underscores that car-sharing and mobility platforms, which routinely collect KYC (Know Your Customer) data, are high-value targets requiring enterprise-grade data governance. Regulatory frameworks such as Japan's Act on the Protection of Personal Information (APPI) impose strict obligations on handling such sensitive records.","**Immediate actions:**\n- Audit and restrict access to databases containing identity documents to only systems and personnel with a verified business need.\n- Encrypt all stored identity documents (e.g., driver's license images) using strong encryption (AES-256) both at rest and in transit.\n\n**Long-term improvements:**\n- Implement a data minimization strategy by retaining identity verification documents only as long as legally required, then securely deleting them.\n- Adopt tokenization or secure third-party identity verification services to avoid storing raw identity document images internally.\n- Establish a formal Data Classification Policy that triggers elevated security controls for any system storing government-issued ID data.\n\n**Detection measures:**\n- Deploy Data Loss Prevention (DLP) tools to monitor and alert on unauthorized access or bulk export of identity document repositories.\n- Enable comprehensive audit logging on all datastores containing personally identifiable information (PII) and review logs regularly for anomalous access patterns.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 3 - Data Protection","CIS Control 6 - Access Control Management","CIS Control 8 - Audit Log Management","NIST SP 800-53 AC-3 - Access Enforcement","NIST SP 800-53 SC-28 - Protection of Information at Rest","NIST SP 800-53 AU-2 - Event Logging","NIST Privacy Framework PR.DS-P","GDPR Article 5(1)(e) - Storage Limitation","GDPR Article 25 - Data Protection by Design and by Default","Japan APPI - Act on the Protection of Personal Information (2022 Amendments)","ISO\u002FIEC 27001:2022 - A.8.10 Information Deletion","ISO\u002FIEC 27001:2022 - A.5.33 Protection of Records","published","2026-10-01T12:21:39.03583+00:00","2026-10-01T12:21:38.729+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fhackread.com\u002Fjapanese-car-sharing-site-times-car-data-breach\u002F","japanese-car-sharing-site-times-car-data-breach-affects-6-6m-accounts-54e952","Japanese Car-Sharing Site Times Car Data Breach Affects 6.6M Accounts",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":45,"name":46,"slug":47,"description":48,"color":49},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]