Security LabInspect with AI
← Incident database

times-car-2026 · Disclosed 2026-09-25

Times Car: member records and identity documents leaked

About 6.6 million accounts were affected, including about 1.6 million identity-document image records. Former members are included; new image-retention rules were announced on October 16.

Cause unresolved / undisclosed

Outcome: Confirmed breach

Entry path and evidence

  • Reported fact

    The scope is about 6.6 million accounts, including about 1.6 million identity-document image records. Do not treat these as deduplicated people or add the subset to the total.

    [s1][s2]第2報 §3 / 第3報 §1
  • Reported fact

    The intrusion route and cause remain under investigation.

    [s1]今後の調査
  • Reported fact

    Previously, identity-document images were retained throughout membership and for seven years after withdrawal for verification, misuse response and inquiries.

    [s4]§1
  • Reported fact

    The company says passwords were stored in a non-recoverable form. The method and strength cannot be independently assessed from this notice.

    [s3]p.1 Q1

Timeline

  1. Incident disclosed. [s5]

  2. Identity-image retention changes announced. [s4]

Reported response

  • Reported fact

    The company reported blocking malicious communications on September 26 and notifying affected users.

    [s1]対応状況
  • Reported fact

    The company announced deletion after registration verification and removal of existing images by the end of October 2026 without requiring requests. Completion has not been verified.

    [s4]§1–2

Cause and mitigation hypotheses

Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.

Evidence relevant to prevention

Insufficient evidence

The entry path cannot be assessed; inspect former-member and applicant retention, identity-document privileges, and access logs.

Editorial assessment; not a determination of liability. [s1]

Unknowns and AI involvement

AI involvementUnknown

The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence.

September 25 is detection and disclosure, not an established intrusion start; vulnerability and patch timing are unknown.

Sources

  1. [s1] タイムズモビリティ · Primary source

    タイムズカーにおける不正アクセスに関するお知らせ（第2報） ↗

    Published 2026-09-28 · Reviewed 2026-10-19

  2. [s2] タイムズモビリティ · Primary source

    タイムズカーにおける不正アクセスに関するお知らせ（第3報） ↗

    Published 2026-09-29 · Reviewed 2026-10-19

  3. [s3] タイムズモビリティ · Primary source

    タイムズカーWebサイトへの不正アクセスに関するご質問と回答（10月16日更新） ↗

    Published 2026-10-01 · Reviewed 2026-10-19

  4. [s4] タイムズモビリティ · Primary source

    「タイムズカーWebシステム」への不正アクセスに関する対応について（第4報） ↗

    Published 2026-10-16 · Reviewed 2026-10-19

  5. [s5] タイムズモビリティ · Primary source

    タイムズカーWebシステムへの不正アクセスに関するお知らせ ↗

    Published 2026-09-25 · Reviewed 2026-10-19