Flaw in Japanese car-sharing service Times Car's web system exploited; licence data of about 6.63 million accounts and about 1.46 million ID images sent out

Abnormal access to the web system of Times Car, the car-sharing service of Japan's Park24, was detected on September 25, and the company announced a possible personal data leak that day and began a forensic investigation ^[1][2]. Findings published on October 23 say the attacker exploited a vulnerability in the web system, and that names, addresses, birth dates, phone numbers, emails and driving licence details of 6,628,007 accounts show traces of access and external transfer, as do about 1.46 million encrypted identity document images ^[1]. Times Car members should check for the company's individual notice and beware of emails, texts and calls impersonating the company without opening their links or attachments; the company says it never asks for passwords or card details through these channels ^[2].

Industries mainly affected: Transportation & logistics

1. Check whether you received an individual notice from Park24 / Times Mobility ^[1].