Investigation Results and Future Response Concerning Unauthorized Access
タイムズモビリティ株式会社 (a consolidated subsidiary of the filing company)
Times Car web system, Times Club web system, and the "Times Car" car-sharing service
Exploitation of a vulnerability in the web systems
Full year ending October 2026
The company will revise its full-year consolidated earnings forecast for the fiscal year ending October 2026. See the "Notice Regarding the Recognition of an Extraordinary Loss and Revision of the Full-Year Consolidated Earnings Forecast" announced on the same day for details.
Related procedures
Report to the Personal Information Protection Commission, consultation with the police, and initial notification to the Ministry of Land, Infrastructure, Transport and Tourism
Personal Information Protection Commission, Ministry of Land, Infrastructure, Transport and Tourism, and police
Company response
A forensic investigation was conducted by an external specialist organization. Going forward, an investigation committee led mainly by the company's outside directors and including external experts will verify its internal controls and governance.
Change to an internal rule not to retain images of identity verification documents after completion of member registration; deletion of currently retained image data of identity verification documents by the end of October 2026; inspections and vulnerability countermeasures for systems with the same configuration; additional measures to strengthen monitoring and detection; and formulation and implementation of measures to strengthen information security and governance
Individual notification to affected customers, support through a dedicated contact center, condolence payments equivalent to ¥3,000 to affected individuals, monitoring of information distribution including on the dark web, confirmation of any actual harm, enhancement of security measures and monitoring systems, and verification by the investigation committee will be pursued. Measures to strengthen information security and governance will be announced by the end of the year.
Specific measures to strengthen information security and governance will be announced by the end of the year.
| Item | Details |
|---|---|
| Event name | Investigation Results and Future Response Concerning Unauthorized Access |
| Date of occurrence | 25 September 2026 (the date abnormal access was detected in the Times Car web system) |
| Date recognized / date notice received | 25 September 2026 (the date the company detected abnormal access) |
| Subject Entity | タイムズモビリティ株式会社 (a consolidated subsidiary of the filing company) |
| Target Locations / Products | Times Car web system, Times Club web system, and the "Times Car" car-sharing service |
| Cause | Exploitation of a vulnerability in the web systems |
| Accounting period in which recognized | Full year ending October 2026 |
| Impact on Earnings Forecast | The company will revise its full-year consolidated earnings forecast for the fiscal year ending October 2026. See the "Notice Regarding the Recognition of an Extraordinary Loss and Revision of the Full-Year Consolidated Earnings Forecast" announced on the same day for details. |
| Type of litigation or proceeding | Report to the Personal Information Protection Commission, consultation with the police, and initial notification to the Ministry of Land, Infrastructure, Transport and Tourism |
| Court or authority | Personal Information Protection Commission, Ministry of Land, Infrastructure, Transport and Tourism, and police |
| Investigation structure | A forensic investigation was conducted by an external specialist organization. Going forward, an investigation committee led mainly by the company's outside directors and including external experts will verify its internal controls and governance. |
| Measures to prevent recurrence | Change to an internal rule not to retain images of identity verification documents after completion of member registration; deletion of currently retained image data of identity verification documents by the end of October 2026; inspections and vulnerability countermeasures for systems with the same configuration; additional measures to strengthen monitoring and detection; and formulation and implementation of measures to strengthen information security and governance |
| Outlook | Individual notification to affected customers, support through a dedicated contact center, condolence payments equivalent to ¥3,000 to affected individuals, monitoring of information distribution including on the dark web, confirmation of any actual harm, enhancement of security measures and monitoring systems, and verification by the investigation committee will be pursued. Measures to strengthen information security and governance will be announced by the end of the year. |
| Planned follow-up disclosure | Specific measures to strengthen information security and governance will be announced by the end of the year. |
Items this document does not state (11)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.The incident was caused by the exploitation of a vulnerability in the web systems. The revision to the earnings forecast reflects various response costs related to the incident.