Times Car breach leaked about 1.6 million driver's license images, operator says
In short
Unauthorized access to the car-sharing service Times Car leaked about 1.6 million driver's license images, while the operator, Park24, had set the images to be kept for seven years after a member withdrew, according to Sankei Shimbun and Livedoor News. The reporting said the apparent disregard of the Personal Information Protection Act's call for businesses to delete unneeded data may have contributed to the long storage and the scale of the leak. More than 30,000 people had indicated intent to join a class action against Park24 as of Oct 5, and Nippon TV News reported anxiety spreading in Oita Prefecture with an expert warning about impersonation fraud.
Read the full story 1 min read
Unauthorized access to the car-sharing service Times Car leaked about 1.6 million driver's license images, according to Sankei Shimbun and Livedoor News, which both cited interviews with the operator, Park24. Nippon TV News reported on the leak and on the risk that the images could be misused. The documents do not describe how the unauthorized access occurred or who was behind it. [ 1 , 2 , 4 ]
Park24 had set the storage period for the images at seven years after a member withdrew, the two outlets reported. The Personal Information Protection Act asks businesses to make efforts to delete data without delay once it is no longer needed, and the reports said the apparent disregard of that provision may have led to the long storage and the scale of the leak. Experts cited in the reports questioned whether keeping the images was necessary, and the coverage described a review of data management as urgent. [ 2 , 4 ]
According to Park24, names, addresses and dates of birth must be retained for seven years under the Corporate Tax Act, but there was no such rule for the license images, which the company said it kept at its own discretion for identity-fraud prevention and inquiry handling. As of late September, when the unauthorized access occurred, the company held data on current members and on people who had withdrawn since September 2019, the reports said. [ 2 , 4 ]
Livedoor News reported that impersonation at financial institutions and elsewhere is feared because of the leaked images, and that inquiries have risen sharply at organizations that handle personal data. The outlet said the number of people indicating they would join a class action against Park24 passed 30,000 as of Oct 5. Nippon TV News reported that anxiety was spreading in Oita Prefecture and that an expert called for caution about special fraud. [ 2 , 5 ]
Why it matters
The leaked license images could be used to impersonate account holders, and Livedoor News reported that institutions handling personal data have seen a surge in inquiries, with financial institutions a particular concern. The disclosure has turned scrutiny on how long companies keep identity documents and on compliance with the Personal Information Protection Act, and the reported class action signals legal exposure for Park24.
Key facts
- Unauthorized access to the car-sharing service Times Car, operated by Park24, leaked about 1.6 million driver's license images. [ 2 , 4 ]
- Park24 had set the retention period for the license images at seven years after a member withdrew. [ 2 , 4 ]
- Park24 said names, addresses and dates of birth must be kept for seven years under the Corporate Tax Act, but that images had no such rule and were kept at its own discretion for identity-fraud prevention and inquiry handling. [ 2 , 4 ]
- As of late September, when the unauthorized access occurred, Park24 held data on current members and on people who withdrew since September 2019. [ 2 , 4 ]
- The Personal Information Protection Act asks businesses to make efforts to delete data without delay once it is no longer needed. [ 2 , 4 ]
- More than 30,000 people had indicated intent to join a class action against Park24 as of Oct 5, and inquiries were rising at institutions that handle personal data. [ 2 ]
- Nippon TV News reported that anxiety was spreading in Oita Prefecture and that an expert called for caution about special fraud. [ 5 ]
Confirmed by several sources
- Nothing is confirmed by two independent outlets yet.
Still unclear
- How the unauthorized access took place and who was responsible. No document describes the method of access or identifies a perpetrator.
- Whether the leaked license images have actually been misused. The documents report concern about impersonation risk, not confirmed misuse.
- The exact breakdown of affected people. The documents give a figure of about 1.6 million images and say data was held on current members and post-September 2019 withdrawals, without a precise breakdown.
- Details of the misuse risk, countermeasures and the situation in Oita Prefecture. Documents 1 and 4 carry only headlines, with no readable article text.
- About 1.6 million driver's license images were leaked through unauthorized access to the Times Car car-sharing service operated by Park24. Reported by a single source so far
- Park24 set the image retention period at seven years after a member withdrew. Reported by a single source so far
- Park24 said names, addresses and dates of birth must be kept seven years under the Corporate Tax Act, while the images had no such rule and were stored at its own discretion for identity-fraud prevention and inquiry handling. Reported by a single source so far
- As of late September, when the unauthorized access occurred, Park24 held data on current members and on people who withdrew since September 2019. Reported by a single source so far
- The Personal Information Protection Act asks businesses to make efforts to delete data without delay once it is no longer needed. Reported by a single source so far
What local media are saying
Timeline, local time
- Unauthorized access occurs; at that point Park24 holds data on current members and on members who withdrew since September 2019. [ 2 , 4 ]
- Nippon TV News publishes a report on the Times Car leak and the risk of driver's license images being misused. [ 1 ]
- Livedoor News reports that the images were kept for seven years after withdrawal and that more than 30,000 people had indicated intent to join a class action. [ 2 ]
- Sankei Shimbun reports on the seven-year retention, Park24's explanation and the call to review data management. [ 4 ]
- Nippon TV News reports anxiety spreading in Oita Prefecture and an expert calling for caution about special fraud. [ 5 ]