The Park24 Times Car data breach is unusual for one reason: the company is paying. Japan’s Park24 announced on Friday 23 October 2026 that it will offer 3,000 yen in compensation, in cash or gift certificates, to more than 1.46 million Times Car users whose identity-document images were transmitted outside the company’s systems. Nikkei Asia converts the payment to about $19; MLex converts it to $20. Our check: at the 23 October rate of about 157 yen per dollar, 3,000 yen is about $19, matching Nikkei Asia’s figure, and Nikkei’s own $28.1 million total for the 4.4 billion yen implies the same rate. The yen figure remains the authoritative one. The breach affected about 6.6 million accounts, including those of former users, exposing names, addresses, and dates of birth. But the payout does not cover everyone whose ID image was touched, and that gap is the story.
Who gets the 3,000 yen, and who does not
The payment goes to customers whose encrypted ID images showed evidence of both access and transmission, according to MLex’s summary of Park24’s statement. That cohort is more than 1.46 million people, and the total compensation cost is estimated at 4.4 billion yen, or $28.1 million. A second cohort gets nothing under this announcement: about 892,000 more ID images were accessed but not transmitted. As our analysis, the maths behind the announcement checks out and exposes the gap at the same time. Multiplying 1.46 million people by 3,000 yen gives 4.38 billion yen, matching the reported 4.4 billion yen total. The compensation is 80 percent of Park24’s 5.5 billion yen extraordinary loss for the fiscal year ending October, leaving about 1.1 billion yen for other incident costs, which Park24 has not itemized. And the exposure is wider than the payout: 1.46 million transmitted plus 892,000 accessed but not transmitted is 2.352 million accounts whose ID images were touched, 35.6 percent of the 6.6 million affected accounts, while only the transmitted cohort, 22.1 percent, gets paid. Mainichi’s 6 October report had put the ID-image figure at about 1.6 million; the 23 October forensic split refines that figure into the two cohorts above, and the two numbers should not be treated as the same group.
How the Park24 Times Car data breach happened
A forensic investigation found that a vulnerability in the Times Car web system was exploited, according to MLex. The dates, reconstructed from the company’s disclosures, run like this:
- 25 September 2026: Times Mobility detects unauthorised access to its web system.
- 28 September 2026: the scope is put at about 6.6 million accounts.
- 6 October 2026: Mainichi puts the ID-image figure at about 1.6 million.
- 16 October 2026: Park24 says it will finish deleting images of identity verification documents, including driver’s licenses, by the end of October 2026.
- 23 October 2026: the forensic split and the 3,000 yen compensation are announced, 28 days after detection.
Park24 said it has secured the intrusion route and plans further security and governance measures by year-end. The attacker identity, the intrusion start date, and whether any leaked data has been misused are all undisclosed, and this article does not label the incident a ransomware attack, because no evidence for that appears in the sources checked.
Why the images were there at all
The most uncomfortable part of the story is not the intrusion but the retention. Park24 had a policy of retaining identity-document images for seven years after memberships were canceled. The company said Japan’s Corporate Tax Act requires it to retain names, addresses, and dates of birth for seven years, but there are no specific regulations governing the images, and it retained them voluntarily to “prevent identity theft and respond to inquiries”. That policy is what kept former members’ ID images in the breached system. The 6.6 million total covers current and former users alike; the seven-year policy matters because it explains why former members’ images, including those of members who had canceled since September 2019, were still in the system years after they canceled. Park24’s own statement, as quoted by Nikkei Asia, is: “Because identity verification documents image data were stored in encrypted form, confirmation of traces of access or external transmission by the attacker does not in itself mean that the image contents immediately became viewable.” The same statement adds: “However, the possibility that externally transmitted encrypted data may be decrypted in the future cannot be completely ruled out.” The encryption is real, and so is the risk it does not eliminate.
What Park24 has promised, and what is still open
Three commitments are now on the record: the 3,000 yen payment to the transmitted cohort, the deletion of ID images by the end of October, and further security and governance measures by year-end. Three questions are still open. First, whether the 892,000 accessed-but-not-transmitted users will ever be compensated. Second, the joint lawsuit: more than 40,000 people had expressed interest in joining a joint compensation lawsuit as of 6 October 2026, according to Mainichi, and a Japanese lawyer was preparing a joint damages suit as of 21 October, according to MLex. Third, whether the transmitted images are ever decrypted or misused, which Park24 itself says cannot be ruled out. No US victims or US service impact have been identified in this coverage; this is a Japan-only consumer incident, and its lesson for readers elsewhere is about retention, not about a payout they can claim.
What to watch next
The end-of-October deletion deadline is the first test, since Park24 promised the ID images would be gone by then. The second is the joint lawsuit, which would scrutinise the seven-year retention policy itself. The third is any disclosure about the 892,000 cohort, who currently sit outside the compensation. And the fourth is any sign that the transmitted encrypted images have been decrypted or misused, which would change the story from a contained payout into an active identity-theft risk. Until then, the honest summary is narrow: 1.46 million people get 3,000 yen each, 892,000 people whose ID images were also accessed get nothing yet, and the images that started it all were kept for seven years by choice, not by law.
Sources
- Nikkei Asia, 23 October 2026 (published 24 October, 00:24 JST): asia.nikkei.com
- MLex, 23 October 2026 (official-statement summary): mlex.com
- Nippon.com (Jiji Press), 16 October 2026: nippon.com
- The Mainichi (Kyodo), 6 October 2026: mainichi.jp
