Times Car Rental says data breach affected 6.6 million accounts

Times Car Rental, the operator of a popular car-sharing service, has revealed that a data breach last week resulted in the leak of information for 6.6 million accounts. The breached data included personal identification documents, making it an exceptionally rare occurrence. The company, Times Mobility, detected the breach early Friday morning and thwarted unauthorized access by the following morning.

Among the accessed documents were personal ID photos, such as driver's licenses, used for verifying personal information. The total accounts breached were those of both current and former Times Car and Times Business Service members, with personal information exposed such as names, home addresses, telephone numbers, and email addresses.

However, no credit card information was compromised. The company has engaged an external forensic investigator to determine the cause and scope of the incident and reported it to the Personal Information Protection Commission and the police. Data security experts have expressed concern over the leaked personal photos, as they could potentially be used for identity theft or fraudulent service verification.

The Credit Information Center and the Japan Credit Information Reference Center have reported high volumes of customer requests for identity verification and credit disclosures, respectively, leading to processing delays and errors. Despite the company's assurance that its services remain unaffected, Times Mobility has initiated contact with affected users and warned them against potential phishing attempts.

The number of unauthorized access cases in Japan has surged, with over 7,190 incidents recorded in 2025, marking a more than fourfold increase since 2021. Recent high-profile incidents include a government network breach exposing hundreds of thousands of employee records and a cyberattack on logistics company Nichirei affecting various sectors nationwide.