SHINDO3

NIPPON Rent-A-Car

NIPPON Rent-A-Car Service, Inc.

nipponrentacar.co.jp

Members55people

POSSIBLE LEAKDriver's licence / Postal addressUnauthorized access · Contained

Open in the live monitor ▶
Disclosed
Oct 1, 2026
Detected
Sep 29, 2026
Detection to disclosure
2 days
Leak
Leak possible
Type
Unauthorized access
Status
Contained
Security spend
Measures, no amount
Compensation
Not announced
Corporate number
6011001018116

What leaked

IdentityFull name, Driver's license information (date of birth), only for members who registered it
ContactPhone number, Email address, Driver's license information (address), only for members who registered it
CredentialsLogin ID
Transactions & activityRental history, Reservation information
ID documentsDriver's license information (license number), only for members who registered it
Financial & paymentLast 4 digits of credit card number, only for members who registered a card, Cardholder name, only for members who registered a card

How many

  • Members 55 people

Who is affected

  • Members

Cause

Unauthorized external access to member information pages of the NR app, using a different method from the first incident announced on September 26

Timeline

  1. Intrusion began
  2. Intrusion stopped
  3. Detected
  4. First disclosure

Response

  • Blocked the entry point
  • Notified individuals
  • Phishing warning

Necessary countermeasures and containment measures carried out. Affected members contacted individually at their registered email addresses. Reported to the PPC and consulted the police. Warned that the company never asks for passwords or credit card details by email, SMS or phone

What you should do

  1. ID numbers can never be changed. Request your credit file from CIC, JICC and others and look for contracts or loans you didn't make
  2. Register a self-declaration (honnin shinkoku) with the credit bureaus so lenders check applications in your name more carefully. The stronger loan self-restriction scheme also blocks your own borrowing and can't be withdrawn for 3 months. Neither stops bank accounts being opened
  3. Even the last 4 digits make a scam call sound genuine. Never give card details by phone or text
  4. Don't open links in emails from this company. The apology email itself may be fake
  5. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  6. Watch for unexpected mail or invoices; your address is hard to change
  7. Check the company's notice to see if you're affected

Lessons for companies

  1. Don't keep ID or bank data: delete after checks or use a KYC provider
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources