Times Car breach: how stolen driver's licenses fuel follow-up scams

A breach does not end when a company blocks the attacker. It ends when the stolen data gets used against the people it belongs to, and that second stage is what matters for the 6.6 million accounts caught up in the Times Car incident. According to BleepingComputer, the Japanese car-sharing service confirmed that a third party accessed its systems at the beginning of September.

Times Car disclosed the intrusion on September 25 and blocked the unauthorized access the next day. It took longer to confirm what had actually been taken. That gap, between blocking an intruder and knowing what they got, is where the mechanism against members starts to matter.

What was actually taken

The confirmed data includes full names, physical addresses, dates of birth, phone numbers, email addresses, driver's license information, and images of identity verification documents. For corporate account holders under the Times Business Service program, department names are also exposed. Account passwords were taken too, though the company says they were stored in a form that cannot be restored, which points to encryption or hashing rather than plain text. Credit card information was not affected.

The step the follow-up scam depends on

None of this data is a working password or a live credit card number. It is instead the raw material for impersonation: a name, a date of birth, a driver's license image, and a real account history with a real company. That combination is enough to make a follow-up phone call, email, or text look legitimate. Someone who calls claiming to be from Times Car, quoting a real address or a real membership detail, sounds credible precisely because the detail is real. The scam does not need to break into the account again; it only needs the victim to believe the caller already has.

Times Car has told members to be cautious of emails, SMS messages, and phone calls claiming to come from the company, and not to open attachments or type in passwords or card details in response to any of them. That instruction only works if members know the breach happened before the follow-up contact arrives. Notifications are going out in stages, not all at once, which means some members will hear about the breach from Times Car, and others may hear about it first from someone pretending to be Times Car.

The company operates 84,000 vehicles across 29,000 stations in all 47 Japanese prefectures, under Park24 Group's Times Mobility. It says there is currently no evidence the stolen data has been distributed online, and a forensic investigation with an external expert is under way to establish the cause and scope of the intrusion.

The tell to watch for is not a broken login. It is an unexpected message that already seems to know something about the account.