6.6M Accounts Exposed in Times Car Data Breach Including Driver's License Images
Written by AI from the linked story. Not reviewed by an editor. How this works
Times Mobility suffered a major data breach exposing personal and identity records for approximately 6.6 million users, including highly sensitive driver's license images for 1.6 million accounts. The exposure of government-issued identity documents represents a severe risk, as this data can enable identity theft, fraud, and account takeover attacks that are difficult for victims to reverse. Organizations that collect and store sensitive identity verification documents must apply proportionally stronger security controls, including encryption at rest and strict access limitations. This incident underscores that car-sharing and mobility platforms, which routinely collect KYC (Know Your Customer) data, are high-value targets requiring enterprise-grade data governance. Regulatory frameworks such as Japan's Act on the Protection of Personal Information (APPI) impose strict obligations on handling such sensitive records.
Tactical Insight
Immediate actions
- Audit and restrict access to databases containing identity documents to only systems and personnel with a verified business need.
- Encrypt all stored identity documents (e.g., driver's license images) using strong encryption (AES-256) both at rest and in transit.
Long-term improvements
- Implement a data minimization strategy by retaining identity verification documents only as long as legally required, then securely deleting them.
- Adopt tokenization or secure third-party identity verification services to avoid storing raw identity document images internally.
- Establish a formal Data Classification Policy that triggers elevated security controls for any system storing government-issued ID data.
Detection measures
- Deploy Data Loss Prevention (DLP) tools to monitor and alert on unauthorized access or bulk export of identity document repositories.
- Enable comprehensive audit logging on all datastores containing personally identifiable information (PII) and review logs regularly for anomalous access patterns.