Tuesday 3 November 2026International EditionRSSMembers
The financial daily of the startup economy
Cybersecurity

Park24's Times Car breach turns stored driving licences into a balance sheet risk

Up to 6.6 million car-sharing accounts were exposed and identity documents from about 1.6 million leaked. Japan's consumer platforms are learning that verification images are a liability.

· · 5 min read
Night photograph for: Park24's Times Car breach turns stored driving licences into a balance sheet risk
Illustration: Invest Times

Park24, the Tokyo-listed parking and car-sharing group, told the Tokyo Stock Exchange on September 28 that an intruder had taken personal data on about 6.6 million accounts from the web system of Times Car, the car-sharing service run by its subsidiary Times Mobility. A day later the company added the detail that matters most: identity documents, chiefly images of driving licences, had leaked from about 1.6 million of those accounts. The intrusion was detected at 9.07am on September 25, and the attacker's route into the system had been cut by 7.25am the following morning.

The numbers are large for a service that, according to BleepingComputer, counted about 4 million active members in August. The gap is explained by what the company kept: the affected population includes former members and even applicants who never completed registration. That is the real story for investors. Consumer platforms in Japan, as elsewhere, have been collecting identity documents to satisfy fraud controls and regulators, then holding them long after the commercial relationship ended. The Times Car case shows how quickly that archive can become a liability.

What Park24 has disclosed

The timely disclosure filed on September 28 lists the categories of stolen data: names, department names for corporate members, addresses, dates of birth, telephone numbers, email addresses, driving licence details, identity document information including licence images, passwords and IDs for linked services. The company says passwords were stored in a form that cannot be restored, and that the linked IDs cover 9 partner services, among them the WESTER ID membership scheme of the West Japan Railway group. Credit card data, it says, was not leaked. Members of Times Business Service, the corporate account programme, and their former members are also affected.

The third update, published on September 29, set out which documents left the building: driving licence images, proof of address such as utility bills, student identity cards for users of the student plan and family verification documents for the family plan. Park24 began emailing the members whose identity documents had leaked that day and said it would give fuller details within about 2 weeks, once an external forensic investigation has progressed. It has reported the incident to the Personal Information Protection Commission and to the police. As of its last update, it had found no evidence that the data had been published or misused, and car-sharing services continue to run normally.

On the financial impact, the filing is brief: the effect on results is under review, and Park24 will disclose promptly if it finds a material effect. The market did not wait. Traders Web reported on September 28 that the shares extended their losses in afternoon trading as news of the breach spread.

Why identity images are different

A password can be reset and a card number reissued. A driving licence image is far harder to replace. It combines a photograph, a name, an address, a date of birth and a licence number in one file, which is precisely the bundle a fraudster needs to open accounts, pass remote verification checks or make a phishing message convincing. Park24 itself has warned members to be wary of emails, text messages and calls purporting to come from the company.

That is why the 1.6 million figure matters more than the headline 6.6 million. Contact details leak often, and their value to criminals is modest. A large archive of verified identity documents, linked to addresses and phone numbers, has a much longer shelf life. The fact that former members were caught up in the breach also raises an uncomfortable question about retention: why was the data still there?

A business already under pressure

The breach lands on the part of Park24 that investors had already been watching most closely. In its results briefing in January, the company said mobility utilisation had been weak in the year to October 2025. It expanded its fleet of dedicated Times Car vehicles by 25.1 per cent to 63,880, but operating profit per vehicle per month fell from 16,800 yen to 13,700 yen, as resources for member acquisition fell short. The third-quarter report released on August 31 again noted that mobility utilisation had fallen below plan, even as group operating profit for the 9 months to July rose 16.2 per cent to 28.9 billion yen.

For the full year to October 2026, Park24 is guiding to sales of 411.0 billion yen, operating profit of 42.5 billion yen and net profit of 44.0 billion yen, with a dividend of 65 yen per share. None of those figures yet reflects the cost of notifying millions of people, running a forensic investigation, upgrading security or any compensation the company may choose to offer. More important than the immediate charges is the effect on the growth plan. Car sharing depends on trust that the operator can safely hold a customer's licence and payment details. A service that needs more members per vehicle can ill afford a reason for prospective users to hesitate.

Japan's pressure on remote verification

The incident also fits into a wider shift in Japanese policy. The amended enforcement rules of the Act on Prevention of Transfer of Criminal Proceeds, promulgated on June 24, 2025, will from April 1, 2027 abolish the method by which customers of specified businesses, such as banks and crypto exchanges, verify their identity by uploading images of their documents, as well as the method based on mailed copies. The replacement relies on reading the IC chip in a licence or My Number card and on public key authentication.

Car sharing is not one of the businesses the rule covers, but the direction is clear: regulators regard document images as weak evidence of identity and a tempting target. Japanese companies have also learned in the past year how expensive cyber incidents can be. Asahi Group suspended operations in Japan on September 29, 2025 after a ransomware attack, and later said data on about 2 million people had been affected. For listed consumer companies, cyber risk has moved from the technology budget to the earnings outlook.

Our view

The lesson of the Times Car breach is less about one vulnerable web system than about a business model habit. Platforms collected identity documents because it was cheap and satisfied compliance, then kept them because deleting data takes effort. That trade-off now looks badly mispriced. Every archive of licence images is a contingent liability that rarely appears in a valuation model.

For investors in listed consumer platforms, the questions to ask are simple: what identity data does the company hold, for how long, and on behalf of whom? For founders in identity verification, the opportunity is equally clear. Chip-based checks that confirm identity without storing a reusable image are moving from best practice to regulatory expectation, and the Times Car case will strengthen that argument with every corporate board in Japan. What to watch at Park24: the forensic findings promised within about 2 weeks, any change in how long it keeps documents, whether it quantifies the cost in its full-year results, and whether membership growth in its mobility business slows.

Sources

Filed under Cybersecurity. Written by Invest Times Editorial under our editorial standards. Commentary and analysis for information only, not investment advice.

More in Cybersecurity

All Cybersecurity analysis