Beware, I used AI to simplify the guide on how to sign-up for the class-action lawsuit
Last month, hackers broke into Times Car (subsidiary of Park 24(4666)), Japan’s largest car-sharing monopoly, and stole 6.6 million user accounts. Inside the data they stole, there were 1.6 million high-resolution photos of Japanese driver’s licenses, utility bills, and student IDs 🪪!
Because Times Car requires a photo of your license when you sign up, my full legal identity is now sitting on a criminal server!
Today, along with over 80,000 other residents of Japan, I am joining the class action lawsuit against them.
Hacked because their software expired… 10-years ago!!
When parent company Park24 announced the breach on September 28, they offered the standard Japanese corporate apology: A deep bow and zero technical details.
Then Japanese security researchers opened the Times Car login page and clicked View Source. Inside the HTML of a ¥300 billion Tokyo Stock Exchange Prime-listed company, they found a digital museum:
Seasar2 and Teeda (
teedaExtension): Times Car built its web system on Teeda, a domestic Java framework tied to Seasar2. The creator of Seasar2 officially declared End of Life (EOL) on September 26, 2016, meaning it has received zero security patches for a decade. Times Car’sajax.jsscript was still using raweval('(' + resText + ')')to execute server responses directly as JavaScript.jQuery 1.2.6: Their login system was loading a version of jQuery released in May 2008, before the iPhone 3G existed, carrying multiple known cross-site scripting vulnerabilities (
CVE-2020-11022andCVE-2020-11023).
Fun(?) fact: Seasar2 reached End of Life on September 26, 2016 and the hack happened September 26, 2026, the exact day on the 10-year anniversary of their framework’s death (yeey?)
Why did Times Car keep your ID for 7 years after you quit?
Even on an unpatched server from 2008, a hacker cannot steal 1.6 million driver’s license photos unless those photos are still sitting on the disk.
The breach hit current drivers, former members who canceled their accounts up to 7 years ago, and even people who quit the signup form halfway through. In Question 8 of their breach FAQ, Times Car gave their excuse for keeping deleted users’ ID photos for 7 years:
“Regarding driver’s license information and images, we retain them for 7 years to prevent identity theft (なりすまし対策) and to handle customer inquiries.”
What scammers can do with your leaked license
Most data breaches expose an email address and a hashed password. Times Car leaked the master key to the Japanese financial system:
Full legal name and date of birth
Current residential address, phone number, and email
High-resolution images of the front and back of your driver’s license
Proof-of-address documents (utility bills, student IDs, family records)
With a driver’s license photo and a utility bill, organized crime groups (トクリュウ) can attack you on three fronts:
Consumer finance loans (サラ金) and credit cards in your name: Japan will not mandate NFC IC-chip scans for online banking verification until April 2027. Right now, plenty of non-bank lenders, BNPL services, and financial platforms still verify identity using photo uploads and an AI selfie check (eKYC). As cybersecurity researchers warned in the Asahi Shimbun this month, scammers feed leaked license photos into deepfake face-swap software to bypass automated eKYC cameras in minutes.
SIM swapping and burner phones: Criminals use leaked IDs and utility bills to open eSIMs or data lines under your legal name for fraud mules.
“Fake Police” extortion: Scammers spoofing Prefectural Police phone numbers can now read your real driver’s license number and address back to you on the phone to “prove” you are a suspect in a money-laundering case.
Japan’s Company Playbook: Never upgrade, never pay
Faced with ruining the personal security of 1.6 million drivers, Park24 went straight to the classic Japanese corporate cover-up playbook:
Make victims pay for their own replacement licenses: Several Prefectural Police departments are allowing Times Car victims to reissue their driver’s licenses with a new final digit (末尾番号の繰り上げ). When asked if Park24 would cover the police fee (around ¥2,500 to ¥3,500), the company told reporters that reissuing a license is “each customer’s personal decision” and told victims to pay out of pocket.
Tell victims to download a free phone app: Instead of providing free credit monitoring or identity-theft insurance, Question 10 of Park24’s FAQ tells victims to go download a free spam-call blocker app from NTT Townpage.
Stall until the outrage dies down: Park24 promised forensic results and a response policy within two weeks of September 29, then waited until the news cycle cooled off to push the announcement back to October 23.
Every traditional Japanese company shares the exact same dream: To never change anything, ever.
They keep running mission-critical databases on decrepit 2008 software because upgrading costs money, forces middle management to take responsibility for a migration, and disrupts the sacred ritual of doing things the way senpai did them in the Heisei era.
For 20 years, the penalty for leaking millions of citizens’ records in Japan has been a press-conference bow and a ¥500 Quocard. As long as getting hacked costs ¥500 per user and modernizing servers costs ¥5 billion, corporate Japan will happily hand your driver’s license to hackers every single time.
It is time to make negligence expensive.
How to join the lawsuit in 30 seconds
If you have ever used Times Car, even if you canceled 6 years ago, you can join the joint damages lawsuit organized by Tokyo attorney Yuki Makino (牧野法律事務所). Past Japanese court precedents for sensitive personal data leaks have awarded between ¥3,000 and ¥30,000+ per plaintiff, and over 80,000 victims have already registered.
Step 1: Register on the lawsuit prep site (¥0 upfront)
Go to timescar-lawsuit.com.
Select 会員 (Current Member) or 退会済 (Former Member).
Enter your full name (氏名), furigana (フリガナ), email, and check the box if you received the license-leak notice.
In the optional details box (具体的な状況), you can leave it blank or briefly note any spam texts you’ve received and whether you are filing with CIC/JICC (for example:
9月下旬の漏えい公表前後から、身に覚えのない不審なメールやSMSが届くようになった。なりすまし被害を防ぐため、信用情報機関（CIC・JICC）への本人申告および運転免許証の再交付手続きも進める予定。).Check the privacy consent box and click 無料登録する. Registration is free and non-binding until you review and sign the formal retainer terms (委任契約書) sent out later.
Step 2: Save your evidence (and avoid the waiver trap)
Save all Times Car emails as PDFs, especially the initial breach notice (
「不正アクセスによる個人情報漏えいに関するお詫びとお知らせ」) and the ID leak notice (「不正アクセスによる本人確認書類情報を含む個人情報の漏えいに関するお詫びとご報告」).If you already quit Times Car and got no email: Request confirmation via their former-member inquiry form and save their reply.
Do NOT sign a liability waiver for a coupon: If Park24 offers apology points or gift vouchers, do not click agree on any clause stating “I confirm there are no further claims or obligations regarding this matter” (
本件に関して、この補償のほかに債権債務がないことを確認する). Accepting a waiver forfeits your right to sue.
Step 3: Lock your credit file (本人申告) and keep the receipts
Filing a Self-Declaration (本人申告) flags your credit file for 5 years so banks and consumer loan companies know your ID was leaked in the Times Car hack, forcing strict verification on any loan application in your name:
CIC (Credit Cards): File online at cic.co.jp/mydata/declare (¥500).
JICC (Consumer Finance): File via the JICC Smartphone App (¥1,000).
Save the receipts and confirmation emails! Makino Law Office is preparing to claim these filing fees and driver’s license re-issuance fees as out-of-pocket damages (実損) in the lawsuit.
Japanese companies will stop running 2008 software on the day that getting hacked costs more than upgrading their servers. Let’s help them do the math.