Image data on roughly 1.6 million people, including photographs taken from driver's licenses used to verify Times Car memberships, is believed to have leaked after a cyberattack on the Japanese car-sharing service, sending long lines to license centers even as police warn that reissuing documents will not stop criminals from abusing data already stolen.
The Japan Times reported Sunday that the breach at Times Car, operated by Park24 Co.'s mobility business, has become one of the country's most consequential identity-theft scares this year because it pairs faces with official license numbers—exactly the combination banks and phone carriers use for remote Know-Your-Customer checks.
What authorities say victims should do
The National Police Agency is urging financial institutions and other businesses to verify identities more rigorously when accounts are opened or passwords reset. It is also asking individuals to contact police immediately if they suspect misuse of personal data.
Police officials have been blunt with worried drivers: applying for a new physical license does not invalidate images already circulating online. The practical defense, they say, is monitoring account activity and reporting suspicious credit or mobile-contract attempts rather than treating a reissue as a reset button.
Why car-sharing holds sensitive documents
Japanese car-sharing operators routinely photograph licenses at signup to meet insurance and road-traffic rules. Times Car is among the largest networks, with vehicles parked in urban lots nationwide. A single compromised reservation database therefore scales into a national problem rather than a regional incident.
Park24 has not, in public statements quoted by domestic media through Sunday, detailed the attack vector or whether encryption keys were taken. Customers are watching for formal breach notifications under Japan's APPI privacy law, which can trigger compensation discussions and regulatory inspections.
Ripple effects for banks and telecoms
Japan already contends with heavy volumes of phone impersonation and phishing that mimics delivery firms. Security analysts say leaked license portraits lower the cost of forging loan applications or SIM-swap requests, especially if thieves pair them with addresses or partial My Number identifiers from older breaches.
Financial groups may temporarily tighten call-center procedures, delaying legitimate customers but slowing criminals. Mobile carriers could demand in-person visits for certain plan changes—a friction Japanese consumers have not seen at this scale since prior hospitality-industry leaks.
What regulators and the company face next
The National Police Agency's guidance shifts some burden to the private sector at exactly the moment Times Car must retain user trust. Expect the Ministry of Economy, Trade and Industry and the Personal Information Protection Commission to press Park24 on retention periods, whether license images needed to stay stored after accounts closed, and audit results from third-party security firms.
For drivers, the actionable steps remain mundane but urgent: enable bank transaction alerts, freeze credit where services exist, and treat unexpected two-factor prompts as potential social engineering. The 1.6 million figure is an estimate; if forensic reviews expand the victim pool, police warnings will widen accordingly.