What happened at Times Car
Times Car, operated by Times Mobility within the Park24 Group, disclosed on September 25 that a third party had accessed its systems, blocked the access the following day, and confirmed on September 28 that personal data had in fact been stolen. The intrusion itself began at the start of September. The company says about 6.6 million current and former members are affected, alongside members of its Times Business Service corporate account program, out of a claimed active membership of roughly 4 million as of August.
The exposed data goes well beyond contact details. Times Car confirmed full names, department names for corporate members, physical addresses, dates of birth, phone numbers, email addresses, driver's license information, scanned identity-verification images such as driver's license photos, account passwords, and linked service IDs were all taken. Credit card information was not affected, and the company said passwords were stored in a form that could not be restored, language that suggests hashing or encryption without specifying which. There is no evidence yet that the stolen data has been published.
Why identity documents are the real liability
Most data governance programs are built around protecting payment card data because PCI DSS makes that obligation explicit and enforceable. Driver's license scans, passport images, and other identity-verification documents collected during onboarding routinely get far less structured protection, even though they are frequently more damaging in the wrong hands. A stolen card number gets cancelled. A stolen driver's license image, paired with a verified address and date of birth, supports identity fraud that can follow a person for years.
Car-sharing, ride-hailing, and short-term rental platforms collect this exact category of data at scale because they need to verify a renter is who they claim to be and legally eligible to drive. That operational requirement exists at the moment of signup or periodically for recertification. It does not require Times Car, or any similar platform, to retain a scanned license image indefinitely once the verification check has been completed and recorded as passed.
The regional pattern behind the number
Times Car is not an isolated event. Macnica, a Japanese security research firm, has logged 119 cybersecurity incidents involving personal information theft or exposed data in Japan so far this year, with 83 of those occurring between July 1 and October 6 alone. That compares with 84 incidents across all of 2025 and 62 across all of 2024 by the same measure, meaning roughly three months of 2026 produced nearly as many incidents as the entirety of last year.
Researcher Yutaka Sejiyama has suggested that cheap, accessible AI tooling may be changing the economics of this kind of attack, making it easier for less sophisticated actors to probe websites and APIs for access-control, configuration, and authentication weaknesses, and to exploit known n-day vulnerabilities before patches are applied. Whatever the precise mechanism, the volume of Japanese breaches this quarter suggests the attack surface is being tested more aggressively and more often than security teams in the region have adjusted for, and there is little reason to assume that pressure is unique to Japan rather than an early signal for every market running similarly aged verification and authentication stacks.
The retention audit most CTOs are overdue for
The direct action item is a data retention audit focused specifically on identity-verification artifacts: scanned IDs, passport images, selfie-match photos, and any document collected to satisfy a know-your-customer or eligibility check. For most platforms, this data has no ongoing operational use after the verification decision is made and recorded, yet it frequently persists in object storage, backup snapshots, and third-party verification vendor systems for years past that point, quietly expanding the blast radius of any future breach without adding any corresponding business value in the meantime.
A practical policy sets a short, defined retention window for the raw document image, tied to the regulatory minimum where one applies, and stores only the verification outcome, not the underlying scan, once that window closes. Where a genuine compliance obligation requires longer retention, that data should sit in a separately access-controlled store with its own monitoring and its own audit trail, rather than alongside the general customer database where a single compromised credential can reach everything at once, which appears to be close to what happened at Times Car.
What this means for the mobility and retail stack
PE-backed platforms in mobility, short-term rental, and any retail vertical that verifies age or identity at checkout are accumulating exactly this kind of data as a byproduct of fraud prevention and regulatory compliance, often through third-party identity verification vendors integrated years ago and rarely revisited since. Few of those integrations receive the same security review as the core transactional database, despite holding data that is arguably more sensitive and, as this incident shows, no better protected against a determined intruder once the perimeter is breached.
Verifying identity remains a legitimate, often legally required control, and nothing here argues for dropping it. The actual fix is to stop treating the verification artifact itself as a permanent asset once the check has served its purpose and been logged. Any CTO who has not recently asked a verification vendor exactly how long scanned documents are retained, where they live, and who can reach them, should treat the Times Car disclosure as the reason to ask this quarter, rather than after the next incident makes the question unavoidable and far more expensive to answer.
