Times Mobility: Times Car member data and licence images leaked

Times Mobility detected and disclosed unauthorized access to the Times Car web system on September 25. On September 28 it confirmed acquisition of about 6.6 million current/former member accounts' information. The September 29 report confirmed identification-document images leaked for approximately 1.6 million of those accounts, including licences and address, student or family documents; these overlapping counts must not be added. Member fields included names, addresses, birth dates, phones and emails. Its October 16 fourth report changed image retention to deletion immediately after registration checks and scheduled deletion of existing images by October-end. The next investigation update was deferred to October 23. Its fifth report on October 23 summed up the investigation. A vulnerability in the web system was the cause, and the attacker reached the database and file storage. About 1.46 million encrypted identity document images show traces of being sent out, and others show traces of access only. The Times Club web system was also breached, leaking 135,436 IDs for partner services, 19,510 Times Club card numbers, the last four digits of 28 credit cards and more. Users whose images were sent out get 3,000 yen in cash or vouchers, and Park24 expects an extraordinary loss of about 5.5 billion yen.