¥3,000 for a Driver’s Licence Scan: Japan’s Times Car Breach and the Price of Identity
How much is a copy of your driver’s licence worth? Japan now has a concrete, if contested, answer. Park24, the parking and mobility group behind the Times Car sharing service, says it will give ¥3,000 in cash or gift cards to roughly 1.46 million users whose identity-document images were sent out of its systems during a cyberattack detected in September.
The numbers behind the apology
The forensic investigation the company published on Friday paints a wide picture. About 6.6 million Times Car accounts had personal details such as names, addresses, dates of birth and licence information accessed and transferred by the intruders. A narrower group, around 1.46 million, also had encrypted scans of driver’s licences and similar documents exfiltrated, and that group is the one eligible for the payment. Park24 expects the gesture to cost about ¥4.4 billion and plans an extraordinary loss of ¥5.5 billion for the business year ending this month, including other breach-related costs.
The company stresses that the images were stored encrypted, so their transfer does not mean anyone can view them today. It also concedes that future decryption cannot be ruled out, which is precisely why it decided to pay.
Why ¥3,000 feels small to some
A law office has already begun gathering affected users for a damages lawsuit, saying more than 90,000 people registered interest, and arguing that the amount is far too low given the risk of impersonation and the time victims may spend dealing with fallout. That criticism touches a real asymmetry. For the company, ¥3,000 multiplied by 1.46 million is a painful one-off charge. For an individual whose licence image surfaces years later in a fraudulent loan or phone contract application, the cost could be far higher and far harder to prove.
Japan has seen this pattern before. Consolation payments of a few hundred to a few thousand yen have become a familiar corporate ritual after large leaks. They acknowledge harm without admitting a specific loss, and they set an informal market rate for privacy that courts have rarely challenged at scale.
The bigger lesson: stop collecting what you cannot protect
Car-sharing services need to confirm that a driver is licensed, but storing millions of full document images indefinitely is a design choice, not a law of nature. Verification could be done once and the image deleted, or replaced with a confirmation flag. Every stored scan is a liability waiting for an attacker.
The breach also lands amid a broader week of nerves in Japanese cybersecurity, with internet group GMO asking the government to adopt “active cyber defence” after unauthorised trades through its services. Companies are discovering that the cost of an incident now includes compensation, lawsuits and lost trust, not just system repairs.
For Times Car users, the practical advice is unglamorous: watch for unusual mail and calls, be suspicious of messages that reference the breach, and check credit records if possible. For everyone else, the episode is a useful question to ask any app that wants a photo of your ID: do you really need to keep it?