BreachPublished 28 Sep 2026

Times Car confirms data breach affecting 6.6 million user accounts

Source Bleeping Computer

Description

Times Car, a Japanese car-sharing service, confirmed a data breach affecting approximately 6.6 million current and former user accounts. The breach involved unauthorized access to personal information including names, addresses, dates of birth, contact details, driver’s license data, identity verification documents, account passwords (stored in a non-reversible form), and linked service IDs. Credit card information was not compromised. The company blocked access shortly after discovery and is conducting a forensic investigation with external experts. Notifications to affected users are being sent in stages. There is currently no evidence that the stolen data has been distributed online.

Impact

The breach exposed sensitive personal information of millions of users, including identity documents and account credentials, which could increase the risk of identity theft, phishing, and targeted social engineering attacks. However, credit card information was not compromised, reducing the risk of direct financial fraud from this breach. The exposure of hashed or encrypted passwords still poses a risk if attackers attempt offline cracking. The incident affects both individual and corporate members of Times Car.

Defensive guidance

Times Car has blocked unauthorized access and is conducting a forensic investigation with external experts. Affected users are being notified in stages. Users should remain vigilant against phishing attempts via email, SMS, or phone calls impersonating Times Car and avoid opening suspicious attachments or providing sensitive information. Since passwords were stored in a non-reversible form, users should still consider changing their passwords on Times Car and any other services where they reuse credentials.

Summary

In early September 2026, unauthorized third parties accessed Times Car's systems, compromising about 6.6 million user accounts encompassing both individual and corporate members. Exposed data includes personal identifiers, contact information, driver’s license and identity verification documents, account passwords stored in a form that cannot be restored (likely hashed or encrypted), and linked service IDs. Credit card data was confirmed unaffected. The company detected and blocked the intrusion by September 26 and is investigating the incident with external forensic assistance. No evidence currently indicates public distribution of the stolen data.

References

bleepingcomputer.com/news/security/times-car-confirms-data-breach-affecting-66-million-user-accounts/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 28 Sep 2026, 20:32 UTC

References

Community reviews