Times Car lost 6.6 million accounts, and the licence photos are the part that will not reset

By Pippa - Published: 9 October 2026

Most breach notices are about records. The one Times Car published at the end of September is also about photographs: of driver's licences, held by a company whose whole business is checking that the person at the counter is the person on the licence. BleepingComputer's account sets out what the Park24 subsidiary has confirmed so far.

What is known

An outside party got into Times Car's systems at the start of September. The company announced the incident on 25 September, cut off the access the next day, and confirmed on 28 September that data had been taken. The affected group is about 6.6 million current and former members of the car-sharing service, plus members of its Times Business Service corporate programme. The company has said it claims roughly 4 million active members, so a good share of that number are people who signed up once and left. Treat 6.6 million as the upper bound: SC Media carries the figures and outlets differ on some details, and the company is still investigating with an outside specialist.

The fields listed are name, address, date of birth, phone number, email, driver's licence details, account password, linked service IDs and, for corporate members, department. Identity verification documents, including licence images, are on the list too. Card numbers are not. Times Car says passwords were stored in a form that cannot be restored, and that it has no evidence yet of the data being published.

Why the licence images matter more than the passwords

A leaked password can be changed in a minute. A photograph of a driver's licence cannot. It carries a face, a home address, a date of birth and a licence number, which is the combination a fraudster needs to pass a "send us a photo of your ID" check at a lender, a mobile shop or an exchange. Visitors who signed up on a foreign licence may be in the pool too, though the company has not said so.

It is also a retention story. A rental operator needs the image at sign-up and perhaps at the first rental. It does not need it six years after the member's last booking, yet "current and former" in the notice tells you the old accounts and their documents were still sitting there.

What to take from it in your own shop

• List every place you keep identity documents, including the vendor that did the check for you and the shared drive someone used for "temporary" uploads. Most firms find at least one copy they did not expect.
• Decide how long an ID image is useful, then delete it on that schedule. Keep the result of the check (verified, date, method) rather than the picture where the rules allow it.
• Store the images apart from the account database, with their own access path and logging, so that a foothold in the application does not hand over the whole archive.
• Check which of your admin and support accounts can bulk-export documents. The timeline here, with access running for weeks before anyone shut it, is a reminder that volume alerts on document reads are worth having.
• Prepare the customer message now: plain advice on phishing, on being asked to re-verify ID, and on contacting their bank. Times Car warned members about suspicious emails, texts and calls, and that is the right first line.

We will update this once the company says how the intruder got in, which is the part that would tell other operators what to fix. If you are reviewing how your own organisation holds customer identity data, write to sales@halfteck.com.