Times Mobility breach exposes driver’s licence data of 1.6 million Japanese users

Times Mobility, the Japanese car‑sharing service, announced a data breach that compromised information linked to roughly 6.6 million user accounts, including detailed identity records for about 1.6 million of those accounts.

The compromised data set contains images of driver’s licences and associated documents, alongside other personal details typically collected for vehicle rental verification. While the breach does not appear to include financial information such as credit‑card numbers, the presence of official identification documents raises concerns about potential identity‑theft or fraud.

Times Mobility operates a fleet of shared vehicles across major Japanese cities, offering short‑term rentals through a mobile app. The platform has grown rapidly as part of a broader shift toward mobility‑as‑a‑service solutions that aim to reduce private car ownership and ease urban congestion.

In Japan, driver’s licence images are considered sensitive personal data under the Act on the Protection of Personal Information (APPI). Exposure of such records can enable malicious actors to impersonate individuals, create counterfeit IDs, or gain unauthorized access to services that rely on licence verification.

Following the disclosure, the company said it is working with cybersecurity specialists to determine the breach’s scope and to reinforce its defenses. Times Mobility also pledged to inform affected users directly and to provide guidance on steps they can take to protect themselves, such as monitoring for suspicious activity.

Regulators are expected to review the incident under the APPI, which obliges organizations to report data breaches that may affect personal privacy. Non‑compliance can result in administrative fines and mandatory corrective measures, prompting heightened scrutiny of the sharing‑economy sector’s data‑handling practices.

The incident adds to a series of high‑profile breaches in the transportation and mobility space worldwide, underscoring the challenge of safeguarding large volumes of personal identifiers collected through digital platforms. Industry observers note that as services become more data‑intensive, robust encryption, regular security audits, and transparent incident‑response plans are increasingly essential.

Users of Times Mobility and similar services are advised to remain vigilant, review any communications from the provider, and consider monitoring their credit reports or employing identity‑theft protection services. The breach also serves as a reminder for policymakers and companies alike to balance the convenience of shared mobility with the imperative of protecting personal information.