JP — ITmedia

Customers to Sue Times Car Operator Over Data Leak, Lawyer Announces at Press Conference

SecurityOctober 26, 20262 min read

A lawyer says he will sue Times Car's operator, Park24, for damages after a data leak exposed personal information of up to about 6.6 million members. Customers have already signed up to join the group lawsuit.

A group lawsuit is planned

Times Car is a car-sharing service. Hackers got into its web system and stole personal data, including driver's license information. Lawyer Yuki Makino held a press conference in Tokyo on October 26, 2026. He said he will file a lawsuit at the Tokyo District Court against Park24, which runs Times Car, and some of its executives. He wants 30,000 to 50,000 yen per victim for emotional distress and other damages.

Key numbers

More than 100,000 people have signed up on the lawyer's lawsuit website, which he opened at the end of September.
More than 25,000 people reported strange emails or messages after the leak.
More than 3,300 people reported misuse of their personal information.
More than 1,200 people reported identity theft, where someone pretends to be them.
Up to about 6.6 million member records may have leaked. Park24 announced this on September 28.

What led to the leak

Park24 spotted the unauthorized access on September 25, 2026. The company later said that images of driver's licenses and other personal data were exposed. Makino says Times Car kept members' license images for seven years, even after they left the service. He will ask the court whether that was reasonable. He also points to rising AI-driven cyberattacks as a reason companies must protect data better.

Why it matters

A driver's license can be used to open accounts or pretend to be someone else, so leaked license images are a serious risk. Makino says the 3,000 yen payment is too low once the cost of getting a new license and stopping misuse is counted. If the case goes ahead, it could show how much companies may have to pay when they lose customer data.

What to watch

When the lawsuit is actually filed, and how many people join it.
Whether Park24 changes its compensation plan.
How the court views keeping license images for seven years after membership ends.
Whether more people report misuse or fake messages as the case goes on.

Glossary

Times Car: A car-sharing service where people rent cars for short periods.
Park24: The company that runs the Times Car service.

Microsoft releases emergency .NET security fixes for Google Brotli bug

Microsoft has issued an out-of-band security update for .NET 8, 9, 10, and 11 to patch a buffer overflow in Google's Brotli compression library, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1. The flaw could let an unauthenticated attacker read or corrupt process memory, leading to information disclosure, denial of service, or elevation of privilege. Microsoft's advisory says exploitation is "More Likely," though it found no evidence yet that criminals are using working exploits in attacks.

SecurityITmediaOct 26

Joshin Unauthorized Access May Have Leaked Up to 6.23 Million Records, Including 2 Driver's Licenses and 1 My Number Card

Joshin, the Japanese electronics retailer that also runs a housing renovation business, said on October 26 that up to about 6.23 million member records may have leaked after unauthorized access to its network, which it had announced on the 17th. The data may include names, addresses, driver's license images, My Number Card information, and login details, and the company said the scope and whether any leak actually occurred are still under investigation. Joshin said it has no credit card information stored and warned users to be alert to suspicious emails, SMS messages, and calls impersonating the company.

Security전자신문Oct 26

Cyber Intrusions Spread to Insurers, Software and Travel Sectors as Financial Sector Breaches Mount

Mirae Asset Life Insurance reported a suspected personal data leak after detecting abnormal activity and notifying the Financial Supervisory Service, marking the insurance sector's first reported intrusion. Separate breaches hit enterprise software firm Douzone Bizon, which is investigating a possible leak of external partner and client employee data tied to a suspected zero-day flaw in backup software, and travel platform NOL, which confirmed leaked data from domestic accommodation booking customers. KB Kookmin Bank said the number of affected people in its earlier breach rose to 2,210 after 2,091 more were identified.