Times Car Data Breach – Japan’s Corporate Response and the Official Fifth Report (October 23, 2026)

On October 23, 2026, Park24 Group released its fifth official report regarding the unauthorized access to the Times Car web system. The investigation, conducted with external forensic specialists, confirmed that personal data had been leaked, including encrypted ID document images, membership information, and user attributes.

This fifth report marks a major turning point: Japan’s corporate response has moved from “investigation phase” to “final confirmation and user compensation phase.”

This article summarizes the official findings, the confirmed scope of leaked data, and the company’s response — providing a clear, expert-level overview for international readers.

1. Timeline of the Incident

Park24 detected abnormal access on September 25, 2026, and immediately began containment and forensic investigation.

Key milestones:

• Sep 25 – Abnormal access detected; system isolation initiated
• Sep 26–28 – Unauthorized access confirmed; initial reports published
• Oct 16 – Fourth report released; ID image retention policy reviewed
• Oct 23 – Fifth report released; leak scope finalized and compensation announced

The fifth report represents the completion of forensic analysis and the transition to user support and governance reform.

2. Confirmed Leaked Data (Final Forensic Results)

The investigation confirmed unauthorized access to both the Times Car Web System and the Times Club Web System.

Times Car Web System

① Personal Information (6,628,007 records) Includes:

• Name
• Address
• Date of birth
• Phone number
• Email address
• Driver’s license details → External transmission confirmed

② Attribute & Identification Data

• Corporate department names: 3,677
• Membership numbers: 8
• Times Business Card numbers: 113
• Linked service IDs: 4 (corrected from 9 in earlier reports)

③ Authentication Data

• Hashed passwords: 4

④ Encrypted ID Document Images – External Transmission Confirmed 1,464,800 records

⑤ Encrypted ID Document Images – Accessed but Not Transmitted 891,602 records

Total ID images accessed: 2.35 million Some were externally transmitted, though encrypted.

Times Club Web System

⑥ Personal Information (5 records) Includes name, address, date of birth, and license details.

Additional leaked data:

• Times Club card numbers: 19,510
• Times Business Card numbers: 12
• Linked service IDs: 135,436
• Credit card last 4 digits: 28 (Full card numbers and security codes were not stored)

3. ID Document Image Retention Policy Abolished

Park24 previously stored encrypted ID document images for:

• Identity verification
• Fraud investigation
• Customer support
• Compliance purposes

Retention period: Membership duration + 7 years after cancellation

After evaluating the risks, Park24 announced:

✔ All stored ID document images will be deleted by the end of October 2026

✔ Future retention will be discontinued entirely

Only minimal “reference hashes” will be kept for future identity verification.

This is a rare and significant shift in Japanese corporate data retention practices.

4. Impact on Users

Park24 states:

• No evidence of leaked data being sold or publicly posted
• No confirmed cases of misuse
• However, risks remain due to the nature of the leaked data

Potential Risks

• Phishing emails or fraudulent websites
• Identity fraud
• Unauthorized applications or inquiries
• Targeted scams
• Long-term risk of encrypted ID image decryption

Park24 continues monitoring the dark web and external data markets.

5. User Support and Compensation

Park24 announced several measures:

① Individual Notifications

Affected users are being contacted directly.

② 24-Hour Inquiry Hotline

Phone: 0120-25-8924 Form: https://share.timescar.jp/inquiry.html

③ ¥3,000 Goodwill Payment (New in Fifth Report)

Eligible users:

• Those whose encrypted ID document images were accessed and externally transmitted

Payment method:

• Cash or gift certificate (details to be announced)

This is not labeled as “compensation,” but functionally serves as a financial remedy.

④ Additional Notifications if New Facts Emerge

6. Cause of the Incident (Confirmed)

The forensic investigation concluded:

✔ A vulnerability in the web system was exploited

Attackers:

• Exploited the vulnerability to gain access
• Explored internal systems
• Used obtained information to access databases and file storage

Technical details were withheld to prevent further attacks.

7. Current Status and Security Measures

Park24 has:

• Closed all intrusion routes
• Patched vulnerabilities in similar systems
• Strengthened monitoring and detection
• Enhanced security governance
• Continued collaboration with external experts

Technical containment is complete, but long-term reforms are ongoing.

8. Future Actions

Park24 will:

• Publish a comprehensive security enhancement plan by late 2026
• Conduct governance reviews through an independent committee
• Continue monitoring for secondary damage
• Provide additional user notifications if needed

9. Summary: Japan’s Corporate Response Model

The Times Car case highlights key characteristics of Japanese corporate crisis management:

Transparency

Five detailed public reports with clear timelines.

Accountability

Direct apology and 24-hour support hotline.

User-first approach

Goodwill payment and deletion of sensitive data.

Governance reform

External experts and independent oversight.

This incident is likely to become a reference case for how Japanese companies handle large-scale data breaches.