Times Car breach exposed 1.6 million driver's license photos and pushed Japanese banks to chip ID checks

What happened

On September 25, 2026, Times Car, one of Japan's largest car-sharing services, detected an intrusion into its web systems. According to a detailed reconstruction published on dev.to, based on the company's five official notices and follow-up bank announcements, the attacker exploited a vulnerability in the web application, moved through the internal network, and reached both the member database and file storage.

The final forensic report, released October 23, put the damage at 6,628,007 accounts whose personal details — names, addresses, birthdates, phone numbers, email addresses and driver's license information — were accessed and exfiltrated. Encrypted ID image data was sent out for 1,464,800 accounts, with another 891,602 accessed but showing no evidence of leaving the network. Credit card numbers were never stored, so they were not leaked. Four hashed passwords were taken.

The images were not only licenses. The dev.to write-up notes they also included proof-of-address documents such as utility bills, student IDs for the student plan, and family documents for the family plan.

Retention made it worse

Times Car's data retention policy is what turned a large breach into one that reached people who thought they were finished with the service. The company kept ID photos for as long as an account was open, and for seven years after a member left, citing fraud checks and identity queries. Notices went to former members on October 1.

Under a policy announced October 16, images are now deleted immediately after registration is verified, and all previously stored images were to be wiped by the end of October. The company is paying ¥3,000 (roughly $19) in cash or vouchers to each person whose ID image data shows traces of exfiltration.

Two details stand out. The images were encrypted, but the company acknowledges it cannot fully rule out that the stolen data could be decrypted later. And beyond naming a web-system vulnerability as the entry point, it has published no technical breakdown of the attack.

Banks abandon photo checks

The consequences moved fastest in banking. Japan's Financial Services Agency asked banks on October 9 to stop relying on photo-based identity verification and instead read the IC chip embedded in Japanese driver's licenses. A shift was already scheduled for April 1, 2027; the leak pulled the timetable forward. A senior official told the Nikkan Kogyo newspaper that fraud techniques are growing more sophisticated, with the paper pointing to AI as the example, according to the dev.to article.

A comparison of 24 banks as of October 23 cited in the article shows the shift underway: Sumitomo Mitsui Trust Bank reportedly ended remote photo checks in March 2026, MUFG Bank required IC chip reading in its account-opening app from May 29, and docomo SMTB Net Bank stopped accepting photo checks for personal accounts on September 28.

Part of a wider wave

Times Car is the largest recent incident in Japan but not an isolated one. Convenience store chain Lawson disclosed on October 8 that its Lawson ID service was accessed between September 12 and 14, leaking 2,155,345 records, mostly names and email addresses; a smaller group also lost gender, phone number and address through prize-draw entries. A separate preorder service leaked 26 records including partial card numbers. Lawson published its genuine notice addresses so customers could distinguish real emails from phishing.

Trend Micro, as cited in the article, counts 593 disclosed incidents in Japan across 2025, 600 in January to September 2026 alone, and 86 in September itself. Its incident responders describe a repeating pattern: a known vulnerability in a public web application, a web shell planted on the server, then privilege escalation and lateral movement toward the database. One attack on cloud provider IDC Frontier hit 495 companies and local governments at once. JR East initially warned up to 2.06 million customer records might have leaked, then said after investigation that nothing did — a correction that traveled far less widely than the original claim.

Why it matters

ID document images have become disproportionately valuable loot because AI has collapsed the cost of misusing them. Online account opening in Japan typically relied on uploading a license photo plus a selfie for a face match, and a genuine license photo paired with a real name and address gives a fraudster a strong head start, whether for synthetic identities or convincing account-opening attempts.

Notably, Trend Micro says it has not confirmed any link between Japan's recent incidents and attackers using AI. What it does credit AI with is faster reconnaissance and vulnerability analysis, more convincing phishing, and eroding the natural protection Japan's language once provided. Among its recommendations to companies: review any process that depends solely on ID photo uploads.

For engineering teams, the takeaway is the rule Times Car adopted under pressure — verify the document, store the verification result, and delete the image itself. Holding millions of high-trust identity documents, including for people who left years ago, is now a liability that outweighs its convenience.