SHINDO7

Times Car

Times Mobility Co., Ltd.

share.timescar.jp

ID documents~1.6Maccountsof ~6.6M accounts affected in total

LEAK CONFIRMEDDriver's licence images / Student ID card imagesUnauthorized access · Investigating

Open in the live monitor ▶
Disclosed
Sep 25, 2026
Detected
Sep 25, 2026 09:07 JST
Detection to disclosure
Same day
Leak
Leak confirmed
Type
Unauthorized access
Status
Investigating
Security spend
Measures, no amount
Compensation
Not announced
Corporate number
7240001015520

What leaked

IdentityFull name, Date of birth
ContactAddress, Phone number, Email address
ID documentsDriver's license information, Driver's license images (image), Proof-of-address documents, Student ID images (image), Family-relationship documents
CredentialsPassword-related information (non-recoverable form)
Account dataLinked-service IDs (9 services, incl. WESTER ID)
Employment & HRDepartment names of corporate members

Not leaked

  • No leak of credit card information has been confirmed

How many

  • Member records ~6.6M accounts
  • ID documents ~1.6M accounts

Who is affected

  • Members
  • Former members
  • People with incomplete registrations
  • Corporate members

Cause

Unauthorized access to the Times Car web system (intrusion method not disclosed)

Timeline

  1. First disclosure
  2. Detected
  3. Update published
  4. Intrusion stopped
  5. Report No. 2 published
  6. Update published
  7. Individual notifications began
  8. Company issued an update

Response

  • Blocked the entry point
  • Forensic investigation
  • New detection
  • Notified individuals
  • Hotline
  • Phishing warning

Investigation by an outside specialist organization; individual notifications to affected people (from 9/29); dedicated helpline (0120-25-8924); warnings about impersonation contacts. Each person is to be notified of their specific leaked items within about two weeks

What you should do

  1. ID numbers can never be changed. Request your credit file from CIC, JICC and others and look for contracts or loans you didn't make
  2. Register a self-declaration (honnin shinkoku) with the credit bureaus so lenders check applications in your name more carefully. The stronger loan self-restriction scheme also blocks your own borrowing and can't be withdrawn for 3 months. Neither stops bank accounts being opened
  3. Change this password and every account that reused it now. Weak passwords crack even when hashed or encrypted. Switch to a passkey where offered
  4. Don't open links in emails from this company. The apology email itself may be fake
  5. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  6. Watch for unexpected mail or invoices; your address is hard to change
  7. Check the company's notice to see if you're affected

Lessons for companies

  1. Don't keep ID or bank data: delete after checks or use a KYC provider
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Lawsuits

Group lawsuit · Recruiting plaintiffsMakino Law Office (attorney Yuki Makino, Tokyo Bar Association)Sign-ups 10,000+ (Oct 2, 2026 13:00 JST)timescar-lawsuit.com ↗

Sources