Times Car, one of Japan's largest car-sharing services, has confirmed that attackers stole data tied to 6.6 million current and former member accounts, including driver's license information and images of identity documents, BleepingComputer reported Monday. The company said credit card data was not affected.

What Happened

According to the company, the intrusion began in early September and unauthorized access was blocked on Sept. 26. Times Car first disclosed a security incident on Sept. 25, then confirmed on Sept. 28 that data had been stolen.

The exposed information includes full names, physical addresses, dates of birth, phone numbers, email addresses, driver's license information, identity verification documents such as images of driver's licenses, account passwords and linked service IDs.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

Times Car said passwords were stored in a form that cannot be restored. That wording suggests they were hashed rather than kept in plain text, but the company did not say which method it used, and the strength of password hashing varies widely between algorithms.

The company has brought in outside cybersecurity experts for a forensic investigation. Its services are running normally, and BleepingComputer reported there is no evidence so far that the stolen data has been published.

Why It Matters

The scale is large relative to the service. Times Car had 4 million active members as of August, so the 6.6 million affected accounts include a substantial number of people who no longer use it but whose records were still held. The service operates about 84,000 vehicles at 29,000 stations across all 47 of Japan's prefectures and is run by Times Mobility, part of the Park24 Group, the parking operator.

The type of data matters even more than the count. Car-sharing services verify that members hold a valid license before letting them drive, which is why Times Car held license details and document images. That same material is what criminals need to open accounts, pass identity checks or impersonate victims elsewhere, and unlike a password it cannot be changed. Combined with names, addresses and birthdates, it makes the stolen set well suited to identity fraud and targeted phishing.

Passwords remain a concern even if hashed. Members who reused their Times Car password on other services face credential-stuffing risk if attackers manage to crack weaker hashes, so changing reused passwords is a sensible precaution.

What to Watch

Times Car said it will notify affected members in stages. It advised customers to be wary of emails, text messages and phone calls that claim to come from the company and ask for passwords or card details, a common follow-on tactic after breaches of this kind.

The forensic investigation should establish how the attackers got in and why access persisted for several weeks before it was blocked. Japanese regulators may also take an interest, given that personal data law in Japan requires companies to report significant leaks to the Personal Information Protection Commission. Any appearance of the data on leak sites or criminal forums would raise the risk for members considerably.