Times Car Confirms Breach of 6.6 Million User Accounts

What Happened

Japanese car-sharing service Times Car has confirmed that a cyberattack disclosed late last week resulted in the compromise of approximately 6.6 million user accounts. Per the disclosure reported by BleepingComputer, details on the specific data types exposed, the attack vector, and any threat actor attribution have not yet been fully disclosed.

Why It Matters

A breach at this scale affects a large population of car-sharing customers, potentially exposing personal account data tied to identity and mobility services. Car-sharing platforms typically hold data such as names, contact details, payment information, and driver's license or identity verification records — any of which, if confirmed compromised, could fuel downstream fraud, phishing, or identity-theft campaigns against affected users. Organizations in adjacent sectors (mobility, subscription services, any business handling large consumer PII stores) should treat this as a reminder that customer-data platforms remain high-value targets.

What Defenders Should Watch For

• Monitor for phishing or smishing campaigns that reference Times Car, car-sharing services, or mobility subscriptions, as breach data is often weaponized quickly for follow-on social engineering.
• Watch for credential-stuffing attempts against unrelated services if users are known to reuse passwords — encourage password resets and MFA enrollment for any customers who may have shared credentials across platforms.
• For organizations running similar customer-facing platforms, review access logging and anomaly detection around bulk data-export or database-query activity, since large-scale account compromises are frequently preceded by unusual data access patterns.
• Track threat-intel and breach-marketplace chatter for Times Car data appearing for sale, which could provide further detail on the scope and nature of the compromised records.

Developing Story

This is a developing disclosure and further details — including root cause, specific data fields exposed, and remediation steps — may emerge as the investigation continues. No CVE has been associated with this incident at this time. For the latest details, see the original report from BleepingComputer.