Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week.
The company announced the incident on September 25, saying that a third party had accessed its systems at the beginning of the month. Times Car took action to block the unauthorized access on September 26.
At the time, the company said it was investigating whether the attackers accessed members’ personal information, but confirmed the data theft in an update earlier today.
The company says that the intrusion affects 6.6 million current and former Times Car members, and also current and former members of the Times Business Service corporate account program.
According to the update, exposed information includes the following data:
- Full name
- Department name for corporate members
- Physical address
- Date of birth
- Telephone number
- Email address
- Driver’s license information
- Identity verification document information, such as images of driver’s licenses
- Account password
- Linked service IDs
The company said that passwords were stored in “a form that cannot be restored,” suggesting they were encrypted or hashed, although it did not provide additional details.
The investigation confirmed that credit card information remained unaffected. Currently, there is no evidence that the stolen data has been distributed online.
Times Car is a major vehicle rental and mobility service operated by Times Mobility, part of the Park24 Group.
It’s a large business with a claimed 4 million active members as of August 2026, allowing online reservations for 84,000 vehicles and collecting them from one of the 29,000 stations it operates across all 47 Japanese prefectures.
The company urged members to be cautious about emails, SMS, and phone calls claiming to come from Times Car, and to avoid opening attachments or typing passwords and credit card details.
The firm is now conducting a forensic investigation into the cause and scope of the incident with the help of an external expert.
Times Car said it would notify affected customers individually, but the notifications would be sent in stages.
Despite the cybersecurity incident, the company assured that all its services continue to operate as normal.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
