A Password Reset Cannot Take Back the Identity Data Stolen From Times Car
Updated 27 October 2026: an account reset cannot retrieve identity information already taken.
How the disclosures developed
The first warning described possible exposure. Detection was at 09:07 Japan time on 25 September. By 07:25 next day, the entry route and attack-source communications were blocked and access failure verified. Dated notices reported normal services and outside investigators. These are historical response statements, not proof that every later risk disappeared. The follow-up notice also reported no further intrusion.
On 28 September, the operator confirmed acquisition affecting about 6.6 million accounts: past and present Times Car members, including unfinished applications, and Times Business Service members. Fields varied: names, corporate departments, addresses, birth dates, phone/email details, licence and identity-document information, passwords and linked-service IDs.
That notice excluded card data and described passwords as non-recoverable, with no readable-password disclosure confirmed. Storage parameters were undisclosed, preventing independent validation of the account-safety conclusion. Its statement of no confirmed public release or misuse was dated. The later findings refine these claims.
The next disclosure put affected document-image accounts at about 1.6 million. It listed driving licences, address evidence, student cards and family documents, and began individual email notices. Later counts differ.
What the later investigation changes
The 23 October findings distinguish encrypted images: 1,464,800 entries had transmission traces; another 891,602 were accessed without such traces. The total is 2,356,402 entries, not unique people. Readability is unproven; future decryption cannot be excluded.
The report counts 6,628,007 account records, including some parking-only customers, and four transmitted password hashes. Linked-service IDs fell to four; WESTER had none. Separate Times Club exposure includes identity data, membership and partner identifiers, and the last four card digits in 28 records. Full card numbers and security codes were not held.
A web-system flaw enabled entry; information found inside enabled database and file access. Technical details remain withheld. Known routes were addressed, comparable systems checked and monitoring strengthened. The attacker is not identified.
Forensics ended; harm monitoring continues. The company knew of no sale or publication. Planned support is ¥3,000 cash or vouchers for customers whose encrypted images have transmission evidence; delivery remains undecided. Governance work continues; plans are expected in 2026. Image-matching verification information will remain after deletion.
The retention rule changed, not the stolen copies
On 16 October, the company replaced image retention throughout membership and seven years after departure with immediate deletion after registration verification. Existing company-held images are promised deletion by the end of October without an individual request. That is not confirmation of completed deletion, retrieval of stolen copies or deletion of all other personal information.
The company first forecast a fuller update after about a fortnight, then rescheduled it for 23 October. That update has appeared. Retention is a measure against future accumulation; it cannot establish what an intruder can do with information already acquired.
Check your own exposure through the official route
The current FAQ says account-specific confirmed fields became available in My Page from 17:00 on 23 October (no time zone stated). A previous email describes what was known when sent, not permanent exclusion of other fields. Former or unsuccessful applicants have a dedicated official enquiry form; former members may have outdated contact details.
It describes additional face, chip and account checks used by financial and telephone providers, without guaranteeing every provider or case. Fraudulent applications and combined methods remain possible. The operator says image deletion will not relax its own fraud checks; implementation remains undisclosed. A credit-agency personal statement can inform lending decisions, but is not guaranteed protection and does not cover deposit-account opening. The company neither recommends nor guarantees that option.
Reach official pages independently. Avoid unexpected links and attachments. Do not provide passwords, card details, replacement ID images or one-time codes to an unsolicited caller or message. The operator says it will not request passwords or card details through email, text or telephone.
Static identity details are not recovery proof
A stolen document combined with a genuine name, birth date or contact details could make impersonation more convincing after a password reset. This is a risk, not confirmation of fraud using these records. Do not treat accurate static details as sufficient proof of identity.
Recovery teams need an independent trusted route before acting on a request containing personal information. Our separate Revolut analysis explains that verification principle. It describes a different incident, not evidence of misuse here.
Sources
Japanese notices and FAQ, translated and paraphrased, not quoted. Rechecked 27 October 2026.
- First notice, 25 September; additions through 1 October.
- Account scope, 28 September; updated 1 October.
- Earlier image estimate, 29 September; updated 1 October.
- Retention change, 16 October.
- Fifth notice.
- FAQ, updated 23 October.
