Park24 Co. Data Breach: What Was Exposed and What to Do

In short: Park24 Co., operator of Japan's Times Car vehicle-sharing service, confirmed that unauthorized access exposed about 6.6 million accounts, with roughly 1.46 million of those including scanned driver's license and identity document images, according to Nippon.com's report on the Park24 breach. Affected users should assume their name, address and ID details are out there, watch for phishing, and change any reused passwords now.

Park24 detected the intrusion on September 25, 2026, and says it blocked the access route the next morning. What follows is what the company and reporting have confirmed, what it means for people whose data was in the system, and what is still unknown.

What data was exposed in the Park24 Co. breach?

The exposed categories include names, addresses, dates of birth, phone numbers, email addresses, driver's license information, identity verification document images, passwords, and linked external service IDs, according to Park24's breach notice. Passwords were stored in a non-reversible, hashed format, which the company says means there is no risk of account misuse from that data alone. No credit card data was confirmed exposed. Park24's fifth official report, posted on October 23, 2026, lays out the incident as a breach of its Times Car web system caused by unauthorized third-party access.

Who is affected by the Park24 data breach?

About 6.62 million accounts were compromised in total, covering current and former Times Car members, people with incomplete applications, and Times Business Service members. Within that group, roughly 1.46 million accounts had identification document images, including driver's licenses, externally transferred, according to Nippon.com's report on the Park24 breach. That means most affected accounts lost contact and account details, while a smaller but still large group also had scanned ID documents taken.

Am I at risk for phishing or identity theft from this breach?

Yes, if your account was among those affected. Attackers with your name, address, date of birth, phone number and email can craft convincing phishing messages that reference real personal details, making scam emails or texts harder to spot than generic ones. Park24 says the exposed ID images were encrypted and "were not immediately viewable," but it has not said the data is safe over the long term, and it plans to "respond appropriately on a case-by-case basis if actual damage occurs," per Nippon.com. Unlike a password, a driver's license image cannot simply be reset, so the exposure risk does not expire on a fixed schedule.

What should I do if my Park24 data was exposed?

Follow these steps if you held a Times Car or Times Business Service account, or submitted an incomplete application:

1. Change your Park24/Times Car password immediately, and change it anywhere else you reused the same password.
2. Treat any email, text or call referencing your Park24 account, driver's license, or personal details with suspicion, even if it looks official.
3. Do not click links in unexpected messages claiming to be from Park24, Times Car, or a "compensation" offer; verify directly through Park24's own channels instead.
4. Watch your bank and credit accounts for unfamiliar activity, since your name, address and date of birth are enough for some forms of identity fraud. If you live somewhere that offers a credit warning or freeze, register one: Danish residents, for example, can file a credit warning through the Central Office of Civil Registration's kreditadvarsel service, which flags your identity to lenders before credit is granted.
5. Keep a record of any suspicious contact or fraud attempt in case you need it for a compensation claim or legal complaint.
6. Review our broader checklist of steps to take after any data breach for additional precautions that apply regardless of where the breach happened.

What does Park24 offer affected users as compensation?

Park24 is paying a 3,000 yen consolation payment, in cash or gift cards, to the roughly 1.46 million accounts whose identification document images were exposed, according to Nippon.com. The total payout is expected to cost about 4.4 billion yen, and the company plans to book an extraordinary loss of 5.5 billion yen for the year tied to the breach. Separately, a law firm, Makino Law Office, reportedly plans to organize affected users to pursue a damages lawsuit against the Times Car operator.

If you have not received a direct notice about the consolation payment, do not assume a message offering it is genuine. Park24 says it plans to notify affected individuals one by one rather than through a public claims site, so any unsolicited email or text asking you to click a link or enter card details to "claim" the 3,000 yen payment should be treated as a likely scam and verified through Park24's own channels before you respond.

What is not known yet?

Park24 has not disclosed the specific vulnerability or method the attacker used to gain access, and no source has identified who carried out the intrusion. Park24 says an external specialist is still conducting a forensic investigation and that affected individuals will be notified individually, per the company's official notice. Until Park24 sends individual notifications, there is no way for an account holder to confirm from the company's public statements alone whether their specific record was among the data taken.

If you're also dealing with other compromised accounts, see our guide to what to do after any data breach for the next steps to take.

Updated 27 October 2026: Added a paragraph warning about scam messages impersonating Park24's compensation payout, plus a closing link to the site's general data-breach checklist guide.