Park24, the operator behind Times Car, will book a ¥5.5 billion (about US$35 million) loss after attackers reached 6.6 million accounts and transmitted encrypted ID-image data, including driver’s licences, for 1.46 million accounts outside the company. Its answer was a ¥3,000 “omimai-kin” consolation payment per affected customer. More than 100,000 people have now signed up for a mass damages claim. Here is what the Times Car breach reveals about how Japan prices a data leak, and why the old playbook is breaking.
On the morning of 25 September 2026, at 9:07 a.m., engineers at Times Mobility detected something wrong inside the web application that runs Times Car, Japan’s largest car-sharing service. By the time the company published its latest investigation findings on 23 October, the scale was clear: personal data tied to 6,628,007 accounts had been accessed, and 1,464,800 encrypted identity-document image records had been transmitted outside the company.
Those images are the heart of the story. To rent a car by the hour from an unattended parking lot, Times Car members had uploaded photos of their driver’s licences, and in some cases utility bills, student IDs and family documents. The company had kept many of those images for years. Now encrypted copies of them had left its systems.
The company’s response was very Japanese. Its parent, Park24, announced it would pay a ¥3,000 consolation payment, in cash or vouchers, to each customer whose ID images left the system, and it booked a one-time extraordinary loss of ¥5.5 billion for the fiscal year ending 31 October. Days later, a Tokyo lawyer announced a mass damages action seeking up to ¥50,000 per person, saying ¥3,000 was too low. More than 100,000 people registered interest.
For international companies that collect personal data in Japan, or plan to, this is worth studying closely. The Times Car breach shows how Japanese companies have traditionally priced a data leak, how that price is rising, and how regulators are using the incident to change the way the whole country verifies identity online.
6.6 Million Accounts, 1.46 Million Driver’s Licences: What Actually Leaked
Start with the scope, because the numbers are larger than most breaches Japan has seen in recent years. According to Park24’s latest report, the exposed data for 6.6 million current and former members included names, home addresses, dates of birth, phone numbers, email addresses and driver’s licence details. Anyone who had ever registered with Times Car, including people who never finished signing up, was told to assume their information had been accessed.
The more serious layer sits underneath. 1,464,800 encrypted identity-document image records were accessed and transmitted externally. Another 891,602 account holders had images accessed but not transmitted, according to reporting on the final report. In total, roughly 2.36 million identity-document files were touched in some way. The Times Club loyalty programme was also reached, exposing about 135,000 linked service IDs and about 19,500 Times Club card numbers (loyalty cards, not payment cards), though Park24 says it does not store full credit-card numbers or security codes.
The attack came in through a vulnerability in the Times Car web application and moved from there into the company’s database and file storage. Park24 has not named the flaw. It says the access path is closed and that systems built the same way were reviewed.
Why does a licence image matter more than an email address? Because in Japan, as in many countries, a driver’s licence is the default proof of identity. It is what you show to open a bank account, sign a phone contract or verify yourself to an online service. A name and an address can be changed or ignored; a licence photo combined with a date of birth is the raw material for impersonation. That is why the National Police Agency issued guidance on 8 October warning businesses to tighten identity checks and warning the public about impersonation scams.
There is also an uncomfortable detail about retention. Times Mobility had been keeping ID images for up to seven years, and had cited identity verification needs and record-keeping obligations under corporate tax law as reasons. On 16 October, the company reversed course: it now deletes ID images once a registration check is complete and no longer keeps images of former members at all. Existing images were scheduled for deletion by the end of October. The policy change is a tacit admission that much of that archive did not need to exist.
¥3,000 Per Person: The Math Behind the ¥5.5 Billion Loss
Now the money. In its 23 October disclosure to investors, Park24 said it expects to record an extraordinary loss of ¥5,500 million in the fourth quarter. The charge covers the cost of incident response and the consolation payments, which Park24’s own English filing calls “Omimai-kin,” to customers whose encrypted ID images showed traces of access and external transmission.
The arithmetic is simple. At ¥3,000 for each of roughly 1.46 million customers, the payments alone come to about ¥4.4 billion. That leaves roughly ¥1.1 billion of the ¥5.5 billion for investigation, notification, call centres, security upgrades and other response costs.
For a company of Park24’s size, the hit is real but survivable. The company kept its forecasts for net sales (¥411.0 billion), operating profit (¥42.5 billion) and recurring profit (¥39.5 billion) unchanged. Only the bottom line moves: profit attributable to owners of the parent falls from ¥44.0 billion to ¥38.5 billion, a cut of 12.5%. The annual dividend of ¥65 per share stays the same.
Two lines in the filing deserve attention. Park24 says it “observed some impact on membership trends in the mobility business” right after the incident was announced. But it also says that “daily sales have remained at pre-Incident levels.” In other words, some people stopped signing up, but the people already using Times Car kept using it.
That is a familiar pattern for network businesses. Times Car’s value to a customer depends on how many cars are parked within walking distance of home or work. A rival with fewer cars is not a real substitute for a commuter who needs a car at 7 a.m. Customers may be angry, but switching costs, in the form of density, convenience and habit, keep them in place. For the company, the breach becomes a one-time accounting charge rather than a lasting loss of revenue, at least for now.
Omimai-kin: Japan’s Apology-Payment Playbook
To understand why the number is ¥3,000 and not ¥30,000, you need to understand a Japanese corporate habit. When a company causes inconvenience or distress, it often offers owabi, an apology, and sometimes a small payment or voucher alongside it. In data-breach cases, this has hardened into a playbook: apologise publicly, notify affected customers, and send everyone a modest, uniform payment that signals sincerity without admitting a specific amount of legal damage.
The landmark case is Benesse, the education company, in 2014. Records for roughly 35 million people leaked through a contractor’s employee. Benesse set aside ¥20 billion for its response and offered affected customers a ¥500 voucher, or the option of donating ¥500 to its children’s foundation. Ten years ago, ¥500 was the reference point that Japanese companies benchmarked against.
The Times Car payment is six times that. And in the same week, another breach pointed in the same direction. GMO Internet, whose remote-desktop cloud service was attacked in October, offered ¥5,000 to every current customer of the service, regardless of whether they suffered losses, plus reimbursement of verified unauthorised trading losses.
Two data points in one month do not make a law, but the comparison with 2014 is hard to ignore: ¥500 then, ¥3,000 and ¥5,000 now. The apology payment is moving from a token gesture toward a meaningful sum, and the more sensitive the data, the harder it is to defend a small one.
There is a strategic logic behind it. A fast, voluntary payment shows contrition, which matters enormously for brand reputation in Japan, and it may reduce the number of customers willing to take the slower and more uncertain route of litigation. Until recently, that bet usually paid off.
The US Comparison: Hundreds of Millions of Dollars, a Few Dollars Each
International readers may assume that American companies pay far more. In total, they usually do. Per person, the picture is more surprising.
T-Mobile’s 2021 breach affected about 76.6 million people in the United States. The company agreed to a $350 million class-action settlement, plus a separate commitment of $150 million to upgrade its security. Divide $350 million across 76.6 million people and you get roughly $4.60 each, before legal fees and administration costs, which come out of the same fund. Equifax’s 2017 breach exposed the data of about 147 million people. Its 2019 settlement with US regulators included a consumer fund of up to $425 million, roughly $2.90 per person on the same simple division.
Now compare Times Car. Park24 is paying about ¥3,000, close to $19 to $20 at recent exchange rates, to each of 1.46 million people whose ID images were sent out. Spread the roughly ¥4.4 billion in payments across all 6.6 million accounts and it is still about ¥665, or roughly $4 per account, in the same range as the American settlements.
These are not like-for-like figures. US settlements include legal fees and claims processes in which only a fraction of eligible people ever file, while Park24 is paying a defined group directly, without anyone having to sue. But the comparison corrects a common assumption. Japan does not pay less per victim because it cares less; it pays through a different channel. The American system relies on courts to set a price after years of litigation. The Japanese system relies on the company to set a price quickly, as an act of apology.
What the US system does produce is pressure. The prospect of a nine-figure settlement forces boards to invest in security in advance. In Japan, the expected cost of a breach has been low enough that many companies treated it as an acceptable risk. That calculation is what the Times Car case may change.
The Class Action Japan Was Not Supposed to Have
For decades, Japanese consumers rarely sued over data breaches, and when they did, courts awarded small sums. In one of the Benesse lawsuits, a Tokyo court ordered the company to pay ¥3,300 each to several thousand plaintiffs who had sought far more, on the reasoning that names and dates of birth are not highly confidential information. Small awards meant few lawyers were willing to organise cases, which meant few cases.
Times Car is different. On 30 September, only five days after the breach was detected, a Japanese lawyer opened a website to collect potential claimants. By 7 October, about 64,000 people had registered. By late October, Yuki Makino of Makino Law Office said he would proceed with a mass damages action seeking up to ¥50,000 (about $320) per affected customer, after Park24 offered what he called a too-low ¥3,000 payment. More than 100,000 people had registered interest, although the final number of plaintiffs had not been fixed.
Three things make this case harder for a company to wave away than Benesse was.
First, the data is more sensitive. Courts have treated names and addresses as low-value information. A stolen licence-image file, linked to an address and date of birth, enables impersonation, and the public now has a vivid example of what that can mean.
Second, the harm is visible. Prefectural public safety commissions began accepting applications for licence reissues under the Road Traffic Act, and by 10 October at least 16 prefectures, including Aichi, Hiroshima, Miyagi and Niigata, were processing them. Every reissue is a trip to a licence centre and a tangible cost to the victim. A police official quoted by the Asahi Shimbun noted that a reissue does not make people feel safe, because it changes the licence number and photo but not the holder’s name, address or date of birth.
Third, online sign-up makes collective action cheap. A lawyer no longer needs to find plaintiffs one by one. A web form, a news article and a social-media post can gather tens of thousands of claimants in a week.
Even if the eventual award per person is closer to ¥3,000 than ¥50,000, the cost of defending a case with 100,000 claimants, and the reputational damage of a long trial, change the economics. The omimai-kin was supposed to make the problem go away. This time it did not.
Regulators Move: The End of the Uploaded ID Photo
The most lasting effect of the Times Car breach may be regulatory. Within two weeks, several agencies acted.
The National Police Agency issued its guidance on 8 October. On 9 October, the Financial Services Agency asked banks and financial firms to stop accepting uploaded photos of ID documents for online account verification early, ahead of an April 2027 legal deadline that was already set before the breach, and to read the IC chips embedded in physical documents instead. Japan’s transport ministry instructed the Japan Rental Car Association to survey its members on data-protection practices and report back by 30 October. And JIPDEC, the body that issues Japan’s widely used Privacy Mark certification, received an incident report; Times Mobility has held the mark since 2021, and JIPDEC’s options include a recommendation, suspension or revocation.
The FSA’s move matters most for businesses. “Take a photo of your licence and upload it” has been the default identity check across Japanese fintech, mobility, sharing-economy and second-hand marketplace apps for years. It is cheap and familiar. It also creates exactly the kind of image archive that was stolen from Times Car. Reading the IC chip, either on a driver’s licence or on the My Number national ID card, verifies the document cryptographically and does not require the company to store a photograph of it at all.
The incident also arrives in a worsening environment. According to reporting on National Police Agency figures, Japan recorded more than 7,190 cases of unauthorised computer access in 2025, more than four times the 2021 figure. The same week Times Car published its report, Nippon Rent-A-Car disclosed a separate, much smaller intrusion affecting 96 members. GMO’s attackers reportedly demanded about ¥8 billion. Cybercrime is no longer a rare event for Japanese companies; it is a regular operating risk.
What International Operators Should Take From This
For foreign companies that sell to Japanese consumers, or are planning to enter Japan, the Times Car case offers five practical lessons.
1. Do not store what you do not need. The single most damaging decision in this case was keeping licence images for years after verification. Design your Japanese onboarding so that ID images are deleted, or never stored, once the check is complete. If you must retain records, keep the verification result, not the document.
2. Move to IC-chip verification early. The FSA has made the direction of travel clear for financial services, and that may influence expectations in other sectors. If your app still asks Japanese users to photograph their licence, plan the migration to IC-chip reading or My Number-based verification now rather than in a rush before April 2027.
3. Budget for an apology payment, and expect it to rise. If a breach happens, a fast, uniform consolation payment is now expected in Japan. The recent reference points have moved from ¥500 to ¥3,000 and ¥5,000, and sensitive data such as ID documents makes a small payment harder to defend. Build that into your incident-response planning and your cyber-insurance cover.
4. Do not assume Japan is litigation-free. Online claimant sign-ups have lowered the cost of organising mass claims. A breach that touches identity documents can now produce six-figure claimant numbers within weeks. Legal reserves and communications plans should reflect that.
5. Speed and sincerity still protect the brand. Park24’s daily sales stayed at pre-incident levels. In Times Car’s case, a dense, useful service and a clear public apology coincided with limited commercial damage so far. Taking responsibility quickly and visibly is the safer default in a market where corporate apologies are closely watched.
Frequently Asked Questions
Q. What is Times Car, and who runs it?
A. Times Car is Japan’s largest car-sharing service, letting members book cars by the hour from unattended parking lots. It is operated by Times Mobility, a subsidiary of Park24, the Tokyo-listed parking and mobility company best known for its Times coin-parking lots.
Q. How much is Park24 paying victims of the data breach?
A. Park24 is offering ¥3,000, in cash or vouchers, to each of the roughly 1.46 million customers whose encrypted ID images showed traces of access and external transmission. It expects a total extraordinary loss of ¥5.5 billion, which also covers incident-response costs.
Q. Why are Japanese breach payments so small compared with US settlements?
A. Japan relies on voluntary consolation payments (omimai-kin) offered quickly by the company, while the US relies on class-action lawsuits that set a price years later. Per person, the amounts are often similar; US settlements are larger in total mainly because they cover far more people and include legal fees.
Q. Can foreign companies still ask Japanese users to upload a photo of their ID?
A. It is still common outside regulated sectors, but the direction is changing. The Financial Services Agency has asked financial firms to stop accepting uploaded ID photos ahead of an April 2027 legal deadline and to read IC chips instead. Companies in other sectors should expect similar pressure.
Conclusion
The Times Car breach will be remembered less for its size than for what it changed. A ¥3,000 apology payment, generous by Japanese historical standards, did not stop more than 100,000 people from signing up to sue. Licence reissues turned an abstract leak into queues at government counters. And regulators used the moment to accelerate a shift, already scheduled for April 2027, away from the uploaded ID photo.
For years, the expected cost of a data breach in Japan was low and predictable: a public apology, a small voucher and a short news cycle. That price is going up. Companies that hold Japanese customers’ identity documents, domestic or foreign, should assume the next breach will cost more, last longer and draw closer regulatory attention than the last one. The cheapest protection remains the simplest: collect less, keep less, and verify identity in ways that leave nothing worth stealing.
If you’re interested in this topic, the Japanese market more broadly, or what KETCHUPs is working on, we’d love to hear from you — please reach out via our contact form.
Japan Market Pulse is a weekly read on what the Japanese consumer-tech, food, and mobility markets are choosing to do, written for international operators who want to know what is happening before it shows up in the global trade press.
Subscribe at ketchups.co/japan-market-pulse.