ENKR

Times Car data breach

Add to my breach check

Made public

What leaked11

Replaceable

  • Password

Hard to replace

  • ID card image
  • Driver's licence number
  • Mobile number
  • Home or delivery address
  • Partial card number
  • Email address
  • Employer
  • Other profile data

Permanent

  • Date of birth
  • Full name
  • ID card imageencrypted images of ID documents such as driving licences: sent out for 1,464,800 accounts, accessed but with no sign of being sent out for 891,602; the company says a future decryption cannot be fully ruled out
  • Driver's licence numberdriving licence information · the notice does not list its fields
  • Password4 accounts, hashed
  • Mobile numberphone number · the notice does not say mobile or landline
  • Partial card numberlast four digits of the card number, 28 Times Club records; the company does not hold full card numbers or security codes
  • Employerdepartment name of corporate members, 3,677 accounts
  • Other profile dataTimes Club card numbers · 19,510, linked-service IDs · 135,436 Times Club and 4 Times Car, Times Business card numbers · 113 and 12, Times Car member numbers · 8

To-dos6 · about 1 h 30 min in all

  1. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover, SMS code theft
  4. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  5. Turn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover
  6. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next18 events

  1. UndetectedNone on record
  2. Response 17 eventsNotice in 3 days · show events
  3. Remedy 1 eventOngoing · show events
  4. PenaltyNone on record
  5. DisputesNone on record
  1. Parent company Park24 expects a special loss of 5.5 billion yen for the compensation and response costs and cut its full-year net profit forecast
  2. Each member's My Page now lists the data found leaked for that member
  3. Cash or vouchers worth 3,000 yen offered to customers whose encrypted ID-document images show traces of having been accessed and sent out; details to follow
  4. Outside forensic investigation ended; final counts published (6,628,007 accounts; ID-document images sent out for 1,464,800) and the cause named as an exploited vulnerability in the web system
  5. Changed its rules: ID-document images are deleted once registration is checked, and all images it holds will be deleted by the end of October 2026
13 more
  1. Began notifying corporate members
  2. Began notifying former members
  3. Began emailing members whose ID-document images leaked · about 1.6 million accounts at the time
  4. No publication of the data and no misuse of it found so far
  5. Began notifying current members
  6. First report to the Ministry of Land, Infrastructure, Transport and Tourism
  7. Began consulting the police
  8. Parent company Park24 filed a TSE notice: data of about 6.6 million accounts leaked
  9. By 7:25 JST, cut the intrusion path and the attacker's connections and confirmed they could no longer get in
  10. Reported to the Personal Information Protection Commission
  11. Opened an inquiry line for the incident
  12. First notice of a possible leak of member data
  13. Detected unauthorised access to its systems at 9:07 JST and started an investigation
Company
Times Car
Company detected it
Made public
Notice
Leak confirmed
Affected
6,628,007 Times Car accounts with traces of their data being sent out · company notice; encrypted ID-document images of 1,464,800 of them were also sent out; the Times Club web system also sent out Times Club records · 19,510 Times Club card numbers, 135,436 linked-service IDs, 28 last four card digits

Sources