The operator of Times Car Rental, a popular Japanese car-sharing service, has announced that a data breach last week compromised information linked to some 6.6 million accounts — including images of personal identification documents, an unusually sensitive category of leaked data.
Times Mobility, the company behind the service, said it first detected the breach last Friday morning and confirmed that an unauthorized third party had accessed company data. The access route was blocked by the next morning.
According to the company's disclosure, about 1.6 million documents were accessed. These included pictures of documents the company used to verify personal information — such as utility bills submitted as proof of home address and student IDs used for student-plan sign-ups. Personal photos were also confirmed to have been accessed through driver's licences.
The breach covers both current and former members of Times Car and Times Business Service. The company said no credit card information was accessed.
Parent company PARK24 said an external specialist is conducting a forensic investigation to determine the cause and scope of the incident, and that it is taking the necessary steps, including reporting to Japan's Personal Information Protection Commission and the police.
Security experts quoted in coverage of the disclosure noted that the leak of personal photos and ID images is rare and particularly concerning, since such material could be misused for identity theft or the fraudulent use of services that require identity verification.
The Credit Information Center, a Japanese credit information agency, said Tuesday that due to high volume, it would be difficult for customers to immediately re-verify their identities or check loan and credit disclosures made in their name.
Sources: The Japan Times
Times Mobility, the company behind the service, said it first detected the breach last Friday morning and confirmed that an unauthorized third party had accessed company data. The access route was blocked by the next morning.
According to the company's disclosure, about 1.6 million documents were accessed. These included pictures of documents the company used to verify personal information — such as utility bills submitted as proof of home address and student IDs used for student-plan sign-ups. Personal photos were also confirmed to have been accessed through driver's licences.
The breach covers both current and former members of Times Car and Times Business Service. The company said no credit card information was accessed.
Parent company PARK24 said an external specialist is conducting a forensic investigation to determine the cause and scope of the incident, and that it is taking the necessary steps, including reporting to Japan's Personal Information Protection Commission and the police.
Security experts quoted in coverage of the disclosure noted that the leak of personal photos and ID images is rare and particularly concerning, since such material could be misused for identity theft or the fraudulent use of services that require identity verification.
The Credit Information Center, a Japanese credit information agency, said Tuesday that due to high volume, it would be difficult for customers to immediately re-verify their identities or check loan and credit disclosures made in their name.
Sources: The Japan Times
