Park24 Co., Ltd.

At the car-sharing service Times Car, roughly 6.6 million members' records from the past seven years, including those of former members, were leaked, and of these, about 1.6 million involved identity verification documents. According to parent company Park24, which operates the service, former members' information such as addresses and names was retained for seven years in line with the Corporate Tax Act, while identity verification documents were kept for seven years on the company's own judgment in order to handle inquiries and similar matters. Professor Ichiro Sato of the National Institute of Informatics pointed out that the documents should have been deleted at the time identity verification was performed, and criticized the handling as sloppy, saying they should have been stored so that they could not be accessed from outside. Yuji Kakeya, principal of the Security Research Center at Macnica, which works on cybersecurity measures, expressed concern that highly accurate personal information, such as that backed by official documents, may sell for a higher price. Experts stress that management should issue a directive and review their companies' data management.

In the case of unauthorized access leading to the leak of member information for the car-sharing service Times Car, parent company Park24 announced on the 29th that the number of accounts whose identity verification document information, such as driver's license images, was leaked came to approximately 1.6 million. The leaked images include driver's licenses as well as utility bills, copies of residence certificates, and student ID cards. Park24 began notifying affected members by email the same day after confirming the leak of their identity verification document information. The total number of accounts whose personal information was leaked through unauthorized access comes to as many as approximately 6.6 million. The company said no cases of misuse of the information have been confirmed at this point.

Park24 announced on the 28th that unauthorized external access to its car-sharing service Times Car resulted in the leak of up to approximately 6.6 million members' personal information. The leaked data includes members' names, addresses, phone numbers, and email addresses, and no fraudulent use has been confirmed so far. Driver's license information, including images, was also leaked, along with membership numbers for services in the JR West group linked through point rewards, and the data includes information on members who canceled their subscriptions over the past seven years. Credit card information was not leaked. Park24 detected the unauthorized access on the 25th and blocked communications from the source of the attack, and said there is no impact on car-sharing use.