In early September 2026, unauthorized third parties accessed Times Car's systems, compromising about 6.6 million user accounts encompassing both individual and corporate members. Exposed data includes personal identifiers, contact information, driver’s license and identity verification documents, account passwords stored in a form that cannot be restored (likely hashed or encrypted), and linked service IDs. Credit card data was confirmed unaffected. The company detected and blocked the intrusion by September 26 and is investigating the incident with external forensic assistance. No evidence currently indicates public distribution of the stolen data.

The breach exposed sensitive personal information of millions of users, including identity documents and account credentials, which could increase the risk of identity theft, phishing, and targeted social engineering attacks. However, credit card information was not compromised, reducing the risk of direct financial fraud from this breach. The exposure of hashed or encrypted passwords still poses a risk if attackers attempt offline cracking. The incident affects both individual and corporate members of Times Car.

Times Car has blocked unauthorized access and is conducting a forensic investigation with external experts. Affected users are being notified in stages. Users should remain vigilant against phishing attempts via email, SMS, or phone calls impersonating Times Car and avoid opening suspicious attachments or providing sensitive information. Since passwords were stored in a non-reversible form, users should still consider changing their passwords on Times Car and any other services where they reuse credentials. No official patch or fix applies as this is a breach incident rather than a software vulnerability.