GM, COT❣️ Yuzunoko here.
Have you ever uploaded an image of your ID when registering for an event or signing up for an everyday service?
On September 25, 2026, Park24, the operator of the car-sharing service Times CAR, detected unauthorized access to its web system. In an announcement on September 28, the company said the number of accounts affected by the leak was up to about 6.6 million. In a further announcement the next day, September 29, it confirmed that identity verification documents, including driver's license images, were leaked for about 1.6 million accounts.
Since the start of October, companies in Japan have kept announcing data breaches.
ID photos come up not only at events but in everyday life. This article rounds up what the announcements tell us and what is worth checking before you hand over an ID. First, the whole flow as a diagram.
What happened, according to the announcements
According to Park24's announcement, the unauthorized access was detected at 9:07 on September 25, and the intrusion route had been blocked by the following day.
The accounts affected by the leak totaled up to about 6.6 million, including current members, people who had canceled their membership, and people whose sign-up was never completed.
The information confirmed leaked includes names, addresses, dates of birth, phone numbers, email addresses, driver's license details, and identity verification documents. Those documents include images of driver's licenses, proof of current address, student IDs, and family verification documents.
The company also announced that credit card information was not included, and that passwords had been stored in a form that cannot be restored.
The company warned that the information "may be misused for spoofed emails, phishing emails, and similar attacks," and asked people not to open links or attachments in messages they do not recognize.
"We will never ask for your password or credit card information by email, SMS, phone, or any other means." That line is worth remembering (the more official a message sounds, the better the moment to stop and check).
Where ID photos come up
In this incident, the people affected were the ones who had uploaded driver's license images for identity checks when they signed up.
Cosplay is no exception: event registration and age checks can involve showing your ID.
But showing an ID in person and sending or handing over an image of it are two different things. If you just show it, that is the end of it. With an image, once you send it, a copy stays on the other side, and asking for it to be deleted later takes another round of effort (and that round of effort is easy to underestimate).
So before you hand one over, pause for a moment and ask, "Do I really need to?" That alone can mean fewer times you hand over your data.
When handing over an ID cannot be avoided, check the recipient's rules to see whether you can leave out details they do not need for the procedure.
What to look at first when a leak is announced
When big news breaks, unverified information spreads on social media too. The first thing to look at is the company's own announcement.
In the Times CAR case, the announcement page lays out what happened and who is affected, and individual notices have started going out by email to the people affected.
On the legal side, leaks affecting more than 1,000 people must be reported to the Personal Information Protection Commission (PPC, Japan's privacy regulator). For larger incidents, you can follow the situation calmly through both the company's announcement and the government framework.
The reliable way to tell whether your information is affected is to compare it against the "scope" listed in the announcement.
Small habits that help, starting today
There is no need for anything drastic. It is about small adjustments to habits you already have.
- Do not open links or attachments in suspicious messages. Do not enter passwords or card details, even if asked
- Stop reusing passwords; use a different one for each service. Turn on multi-factor authentication wherever it is available
- When you are asked for an ID photo, check what it is for and how it will be stored before you send it
IPA (Information-technology Promotion Agency) lists unauthorized logins to online services and phishing among the threats aimed at individuals in its "Top 10 Information Security Threats 2026."
Data breaches can happen close to home, in the services you use every day. That is exactly why it helps to prepare through small extensions of your daily habits.
Driver's license reissuance, and where to ask for help
In Japan, driver's licenses can be reissued. The procedure is normally for lost or stolen licenses, but in this case, reports say that Yamagata Prefecture and other areas have started accepting applications from people whose information may have been part of the leak.
The offices that handle the procedure are the driver's license division or a police station in the prefecture where you live. Required documents and fees are listed in each prefecture's guidance.
Here are the main places to check:
- Times CAR announcements and inquiry desk: 0120-25-8924 (24 hours)
- Personal Information Protection Commission: information on breach reporting and a consultation desk for individuals
- Driver's license reissuance: your prefecture's driver's license division or a police station (Yamagata Prefecture's example is on its prefectural police website)
Phone numbers and opening hours can change, so please check each website before you call. If you are worried that you might be affected, you do not have to carry it alone: talk to an official desk or the company's inquiry line.
About this article
This article is based on announcements from Park24 (reports 1 through 3), materials published by the Personal Information Protection Commission, and procedure guidance from the Yamagata Prefectural Police. Figures are as of their publication.
The situation can change, so check the company's announcement page for the latest on who is affected and what to do. This article is not a recommendation of any specific service or course of action.
Quotes from Japanese sources are our own translations.
Translated from the Japanese original.
See you next time on COT❣️