Times Car

Profile narrative

Times Car operates a nationwide car-sharing service in Japan, maintaining a fleet of tens of thousands of vehicles distributed across thousands of stations throughout the country. The service provides members with access to vehicles for short-term use, supporting both individual and corporate customers through a network that spans the Japanese archipelago. Corporate members are enrolled with department-level affiliation data stored alongside personal information, indicating a structured B2B offering alongside consumer-facing operations. The platform also retains identity verification documents, driver's license details, and linked service identifiers as part of its user onboarding and compliance processes.

The scale of the operation is reflected in the size of its user base, which reached approximately 6.6 million accounts at the time of a confirmed cyberattack in early September 2026. Unauthorized access to systems was detected and blocked within a day, but not before threat actors exfiltrated a broad set of personal data including full names, physical addresses, dates of birth, telephone numbers, email addresses, driver's license information, and images of identity verification documents. Stored passwords, protected through hashing or encryption, were also accessed, though credit card information remained unaffected and there is no evidence the data has been published or disseminated online. The breach represents one of the largest data compromises in Japan's mobility sector to date.

In response, Times Car engaged external forensic experts to investigate the intrusion and has committed to notifying affected individuals in stages while maintaining normal service operations across its network. The company's ability to continue operating its fleet and station infrastructure without disruption suggests a degree of operational resilience despite the severity of the data loss. The incident has drawn attention from Japanese cybersecurity authorities and industry observers, highlighting the growing risk to critical transportation infrastructure and the sensitive personal data managed by shared-mobility providers.

Incidents

1 incident linked to this organisation.