Science & Tech · Cybersecurity · 2 hrs ago
Times Car to pay ¥3,000 to each of 1.46 million affected users
Park24, which runs Japan’s Times Car car-sharing service, said it will pay ¥3,000 to each of about 1.46 million people affected by a data breach.
Attackers exploited a weakness in the service’s web system, which the company detected in September.
The affected images included driving licences and other identity documents, and were sent out in encrypted form.
Encryption means the images may not have been readable, but Park24 said it cannot rule out the possibility that the data could be decoded in the future.
The breach also exposed personal information linked to about 6.6 million accounts, including names and addresses.
Park24 says it has not found evidence that the stolen information was sold or made public, and that it does not hold full credit card numbers or security codes.
It will delete stored identity document images by the end of October and continue monitoring for misuse; it plans to announce further security and governance measures by year-end.
Park24 will pay ¥3,000 in cash or vouchers to each of about 1.46 million Times Car users whose identity-document images showed signs of access and external transmission.
The images were stored in encrypted form, so the company said the signs do not mean their contents were immediately readable.
Park24 said it cannot completely rule out the possibility that the encrypted data could be decrypted in the future.
The incident involved unauthorized access to Times Car’s web system and the theft of personal information.
The company said it has fixed the confirmed intrusion route and will delete the identity-document images it still holds by the end of October 2026.
- Who
- Park24, which operates Times Car, and about 1.46 million affected users.
- What
- Park24 will provide each affected user with ¥3,000 in cash or vouchers after signs showed their identity-document images were accessed and sent externally.
- When
- Park24 announced the payment on October 23, 2026.
- Where
- Times Car’s web system was affected.
- Why
- Park24 said the payment recognizes the concern and burden caused by the incident and the possibility that encrypted data could be decrypted in the future.
This story does not have two clearly opposing sides.
Park24 detected unusual access to the Times Car web system and began investigating and containing the incident.
Park24 reported that about 1.46 million identity-document images showed signs of external transmission and announced payments of ¥3,000 to affected users.
Park24 said it would delete the identity-document images it still holds.
- Affected image records
- About 1.46 million
- Payment per person
- ¥3,000 in cash or vouchers
- Accounts with leaked personal information
- About 6.6 million, including former users
- Planned deletion
- Identity-document images held by Park24 to be deleted by the end of October 2026
- Special loss forecast
- ¥5.5 billion for the fiscal year ending October 2026
3 sources
What people are saying
We take this matter seriously and will make efforts to prevent a recurrence and regain trust.
We cannot completely rule out the possibility that the encrypted data sent externally may be decrypted in the future.