Hackers Stole 6.6 Million Driver's License Photos From a Car-Sharing App

When Your Face Becomes the Fraud

Passwords get reset. Card numbers get cancelled. Your face, your home address, and your driver's license number stay exactly the same for the rest of your life.

That is what makes the Times Car breach different from nearly every data incident you have heard about before.

Times Car, Japan's largest car-sharing service and a subsidiary of Park24, confirmed on September 30, 2026, that attackers gained unauthorized access to its systems. The company detected the intrusion on September 25. Investigators believe the attackers had been inside since early September. That means roughly a month passed before anyone noticed.

What Did the Attackers Actually Take?

The stolen data falls into two categories, and both are serious.

The first is account information: full names, home addresses, birthdates, phone numbers, email addresses, and driver's license numbers. This covers approximately 6.6 million user accounts. Japanese authorities and media have described it as the largest leak of identity verification document images in Japan to date.

The second is document images. Times Car, like most car-sharing services, requires users to upload scans of identity documents before they can drive. Attackers accessed roughly 1.6 million of those files. These are actual photographs of driver's licenses, utility bills, and student IDs.

The second category is what matters most. A stolen password is a string of characters you can change tonight. A stolen photo of your driver's license contains your face, your signature, your date of birth, your address, and your license number, all in one image. You cannot change any of it.

Why This Breach Has a Long Shelf Life

Most breaches peak in usefulness for criminals within weeks. Password dumps go stale when users change credentials. Card numbers expire or get flagged.

Identity document photos do not expire the same way.

A criminal with a high-resolution scan of your driver's license can apply for credit in your name. They can file tax returns, claim refunds, or open bank accounts. They can build synthetic identities that combine your real details with fabricated ones, then use those across multiple institutions. The fraud you suffer from this breach could surface in three months or in three years.

You signed up for a car-sharing app. You uploaded a document because the platform required it. The platform held that document for years, and you had no practical way to retrieve or delete it afterward.

The Numbers

6.6 million accounts compromised.

1.6 million identity document images accessed, including driver's licenses, utility bills, and student IDs.

One month the attackers operated inside Times Car's systems before detection.

Passwords were hashed, stored in a scrambled format that cannot be directly reversed. No payment card data was taken. Those are genuine positives inside an otherwise severe incident.

Times Car has reported the breach to Japan's Personal Information Protection Commission and to police. An external forensic investigation is ongoing.

What Should You Do Right Now?

If you are a Times Car user, act immediately. If you are not, read this anyway. Any service that required you to upload an identity document, anywhere, carries this same risk profile.

1. Freeze your credit. Contact the major credit bureaus individually and place a freeze on your file. It is free. It blocks new credit from being opened in your name without your involvement, and it does not affect your existing accounts. Other countries have equivalent services. Do this before anything else.

2. Check for accounts you did not open. Review your credit reports for unfamiliar inquiries or new accounts. Most countries offer free annual access through official government-backed services.

3. Expect targeted phishing. The attackers now know your phone number, email address, and home address. Watch for scams that reference your real details to seem credible. A message that uses your full name and address is not trustworthy just because it knows those things.

4. Enable two-factor authentication everywhere. Especially on email, banking, and any account tied to your identity. Use an authenticator app rather than SMS text codes where possible.

5. Activate identity monitoring. Many banks and credit card providers now include identity monitoring at no extra cost. Check if yours does and turn it on.

6. Document everything. If you discover fraud, file a report with your national consumer protection agency from day one and keep a paper trail.

The Real Problem Is Not This One Breach

Every app that collects identity documents becomes a target. Not a potential target. A target. The economics are straightforward: one successful intrusion gives attackers millions of files worth far more on fraud markets than stolen passwords or card numbers.

The incentive to collect this data is strong. The incentive to protect it, store as little as possible, and delete it after verification is weak. That gap produces incidents like this one, repeatedly.

You did not make a mistake by using Times Car. But the pattern should shift your defaults going forward. Be more reluctant to hand identity documents to services that do not obviously need them long-term, and assume that anything you upload could eventually be exposed.

Do this now:

• Freeze your credit at all major bureaus (it is free)
• Check your credit report for unfamiliar accounts or inquiries
• Turn on two-factor authentication on email and financial accounts
• Stay alert to phishing that uses your real name and address to build false trust
• If you used Times Car: monitor your identity for years, not just weeks

Sources

• japantimes.co.jp
• scworld.com