Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week.
The company announced the incident on September 25, saying that a third party had accessed its systems at the beginning of the month. Times Car took action to block the unauthorized access on September 26.
At the time, the company said it was investigating whether the attackers accessed members' personal information, but confirmed the data theft in an update earlier today.
The company says that the intrusion affects 6.6 million current and former Times Car members, and also current and former members of the Times Business Service corporate account program.
According to the update, exposed information includes the following data:
- Full name
- Department name for corporate members
- Physical address
- Date of birth
- Telephone number
- Email address
- Driver’s license information
- Identity verification document information, such as images of driver’s licenses
- Account password
- Linked service IDs
The company said that passwords were stored in “a form that cannot be restored,” suggesting they were encrypted or hashed, although it did not provide additional details.