Park24 (Times Mobility / Times Car car-sharing in Japan) is on the breach ticker after its second official notice on September 28, 2026, following a first notice on September 25.
Park24 says unauthorized access to the Times Car web system was detected at 09:07 JST on September 25. The identified path was blocked by 07:25 JST on September 26, and the company reports no new unauthorized access since that block.
Investigation confirmed that a third party acquired approximately 6.6 million accounts (約660万件): Times Car current and former members (including incomplete signups) plus Times Business Service current and former members. Fields vary by subject and can include name; corporate department; address; date of birth; phone; email; driver’s license information; ID-document images (for example license photos); passwords in unrestorable / hashed form (Park24 says they are not usable to hijack accounts); and linked service IDs (for example JR West WESTER ID; nine linked services in total). Park24 states credit card information was not leaked. As of the Sep 28 notice, there is no confirmed public dump or confirmed misuse.
Park24 notified Japan’s Personal Information Protection Commission (PPC) and police. External forensics are ongoing; individual notices are staged; the company is warning members about phishing; services are described as operating normally. Actor and root cause remain Undisclosed in the primary notices.
POV: a national car-share roster with license images and linked-service IDs is an identity-theft and targeted-phishing event even when card PANs stay off the dump. Underwrite Park24’s 約660万件 count and field list from the Sep 28 第2報; attribution and exploit path remain Undisclosed until they print one.