Japanese car-sharing provider Times Car has confirmed that attackers obtained information associated with approximately 6.6 million current and former customer accounts. Operator Park24 detected unauthorized access on September 25 and later verified that data stored in the affected web system had been taken by a third party.
The exposed records include identity documents
Park24 said the affected data varies by customer but can include names, addresses, dates of birth, telephone numbers, email addresses, driving-license information, identity-document images, account passwords and linked-service identifiers. Corporate member records may also include department names.
The company said passwords were stored in a form that could not be restored and that credit-card data was not affected. It reported no evidence at the time of publication that the stolen information had been publicly distributed, but warned customers about phishing, impersonation messages and fraudulent calls.
Mobility platforms hold high-value identity data
Car-sharing services combine identity verification, transport records and account access in one environment. Operators should separate document stores, monitor privileged access and rehearse customer notification before an incident. Affected users should verify messages through official channels and avoid links requesting credentials. SectechMedia tracks related risks in its transportation security coverage.
Leave a Reply