Loading story…
Japanese car-sharing service Times Car, operated by Park24 Group subsidiary Times Mobility, confirmed that unauthorized access to its systems exposed personal information for approximately 6.6 million current and former individual and corporate-program members. The intrusion began in early September 2026, was detected on September 25, and the identified access route was blocked by September 26.
The compromised data includes names and contact details, dates of birth, account and identity-verification information, driver’s-license data, and IDs linked to nine partner services. Passwords were stored in a non-reversible format and no credit-card information was affected. Park24 has notified Japanese privacy regulators and police, retained external forensic specialists, and will contact affected members in stages while warning them of phishing and impersonation via email, SMS, and phone calls.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Park24 confirmed that the intrusion exposed personal data of approximately 6.6 million Times Car and Times Business Service accounts, including identity, contact, driver-license, verification-document, password, and linked-service ID data. The company said credit-card data was unaffected, reported the incident to Japanese privacy regulators and police, and engaged external forensic specialists.
Times Mobility blocked the identified access route at approximately 7:30 a.m., ending communications with the attacker.
Times Mobility detected unauthorized access to its systems at approximately 9:10 a.m. The company publicly disclosed the incident the same day.
A third party began accessing systems operated by Times Mobility, which runs the Times Car car-sharing service. The intrusion ultimately exposed data associated with current and former individual and corporate-program members.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mazda Motor Corporation disclosed that attackers gained unauthorized external access to an internal warehouse management system used for parts procured from Thailand, exposing **692 records** tied to employees, group company staff, and business partners. The company said the intrusion was detected in mid-December 2025 and traced to exploitation of an unpatched vulnerability in the affected system. Exposed information may have included user IDs, full names, email addresses, company names, and business partner IDs, while Mazda said **no customer personal data** was stored in the compromised environment. Mazda reported the incident to Japan’s Personal Information Protection Commission, investigated the breach with external cybersecurity specialists, and publicly disclosed the matter after completing its review. The automaker said it has patched the system, revised architecture, reduced internet exposure, restricted source IP access, strengthened monitoring, and tightened access controls, with plans to apply similar protections elsewhere. Although Mazda said it has not confirmed misuse of the data or other secondary damage, it warned affected individuals about elevated risks including **phishing**, **business email compromise**, and targeted spam.
Jun 29, 2026
Carnival Corporation disclosed a data breach after a threat actor used social engineering to compromise an employee account and gain unauthorized access to a limited portion of the company’s internal IT systems. The company said it detected suspicious activity on April 14, contained the intrusion with help from third-party cybersecurity specialists, and confirmed by April 22 that customer personal information had been copied from affected systems. The exposed data included names, addresses and other contact details, dates of birth, government-issued identification numbers linked to passports and driver’s licenses, and in some cases Social Security numbers. Reports said about **6 million** people in the United States may be affected. Carnival began notifying impacted individuals on May 27, issued a public notice for people it could not contact directly, and is offering **24 months** of complimentary credit monitoring through **TransUnion MyTrueIdentity**. The company has not identified the threat actor or said whether ransomware or extortion was involved.
Jun 29, 2026
An unidentified actor breached Norwegian micromobility provider **Ryde**'s IT environment in early August and copied customer data affecting its entire reported user base of approximately **4.5 million accounts** across Norway, Sweden, Finland, and Germany. Swedish Television reported that up to 1.3 million of the affected accounts belonged to users in Sweden. Ryde has not identified the attacker or disclosed the initial access method. The exposed data includes phone numbers, email addresses, dates of birth, partial payment-card numbers, and, for some users, payment histories for rides and fees; journey histories were not affected. The data may enable Ryde-themed phishing and smishing, payment scams, credential stuffing, and targeted social engineering, particularly against organizations whose employees registered using corporate email addresses or reused passwords. Organizations should monitor for related phishing activity and credential-stuffing attempts against identity and remote-access services.
Sep 16, 2026