Tokyo-listed parking and mobility operator Park24 will pay ¥3,000 in cash or gift cards to 1.46 million car-sharing customers whose personal identification records were compromised in a cyberattack.
The payouts will cost approximately ¥4.4 billion, forcing the operator to book an extraordinary loss of ¥5.5 billion for its fiscal year ending October 2026.
Total unauthorized access hit 6.62 million user accounts on the group’s flagship Times Car network. Park24 confirmed that external actors extracted stored identification images, including driver’s licenses, from 1.46 million of those profiles. The company maintains that the files were encrypted and were not immediately readable at the point of extraction, pledging to review individual cases if verified financial damage emerges.
The Cost of Driver Verification Failures
Park24 restricted the ¥3,000 consolation sum strictly to the subset of members whose scanned identification documents were transferred outside its servers. The remaining 5.16 million affected account holders will receive no direct payout under the present scheme.
For Japanese app-based mobility providers, digital know-your-customer data forms the core operational bottleneck. Fleet operators require high-resolution driver’s license scans to validate bookings and satisfy Japanese transport regulations. When those image repositories leak, consumers face identity theft risks that basic password resets cannot address.
Settling customer goodwill for roughly $19 per compromised identity card represents a defensive maneuver. The flat payment aims to head off churn across urban hubs where Times Car competes against railway operators and leasing conglomerates for shared-fleet market share.
Mounting Class Action Resistance
Consumer acquiescence is far from guaranteed. Tokyo-based Makino Law Office confirmed plans to organize affected Times Car drivers and file a joint damages lawsuit against the mobility operator.
Attorney Yuki Makino characterized the compensation plan as inadequate for the long-term administrative burden imposed on drivers. More than 90,000 vehicle-sharing members have already enrolled online to join the collective legal action.
The legal push challenges the standard Japanese corporate playbook of issuing small fixed-value gift vouchers after systemic cybersecurity failures. If the lawsuit secures broader certification or forces higher restitution tiers, legal liabilities will spill over into the group’s 2027 accounts.
Prior Intrusions Across Consumer Networks
The incident traces back to September 2026, when security teams at Park24 initially spotted unauthorized access within Times Car network infrastructure.
Corporate Japan has faced an intense run of consumer-facing breaches throughout 2026. Official tallies recorded over 19,000 personal data breaches nationwide during fiscal 2025, prompting trade bodies and digital agencies to tighten oversight rules.
Park24 now enters its next financial reporting cycle with an open legal docket, as Makino Law Office prepares its court filings against the car-sharing operator.
