Car-sharing service Times Car confirms breach exposing 6.6 million accounts

Park24 Group said its car-sharing subsidiary Times Car suffered a data breach that exposed personal information from approximately 6.6 million current and former member accounts, the company confirmed this week.

Times Mobility, the Park24 subsidiary that operates Times Car, detected unauthorized access to its systems at about 9:10 a.m. on Sept. 25, after an intruder had accessed the systems earlier in the month. The company blocked the access route by about 7:30 a.m. the following day, cutting off communication with the attacker. Park24 confirmed the scope of the breach in an announcement on Sept. 28.

The breach affected both Times Car member accounts and corporate Times Business Service accounts, as well as IDs linked to nine external partner services, including JR West group member services. Exposed information included full names, department names for corporate members, physical addresses, dates of birth, phone numbers, email addresses, driver’s license information, identity-verification documents such as license images, account passwords and linked service IDs. The company said passwords were stored in a format that cannot be restored, meaning they were likely encrypted or hashed, though it did not provide further technical detail, and said there is no risk of the passwords being used. Credit card information was not affected, and the company said there is currently no evidence the stolen data has been distributed online or misused.

Times Car said it operates about 4 million active memberships as of August 2026, offering online reservations for 84,000 vehicles across roughly 29,000 stations in all 47 Japanese prefectures. The company said its services continue to operate normally despite the breach.

Park24 said it reported the incident to Japan’s Personal Information Protection Commission and police, and is conducting a forensic investigation into the cause and scope of the breach with outside specialists. The company said it plans to notify affected customers individually, in stages, and is considering medium- to long-term measures to prevent a recurrence, which it will disclose once finalized. Park24 said the potential impact on its financial results is still under review and will be disclosed promptly if a material impact is identified.

The company urged members to be cautious of emails, text messages and phone calls claiming to be from Times Car and to avoid opening attachments or entering passwords or payment information in response to such messages.