Personal information from about 6.6 million accounts was exposed, including photos of identity documents from 1.6 million accounts; data from former members had been retained for seven years.
Japanese police say reissuing a driver’s license offers limited protection against identity theft, and have asked financial institutions to strengthen identity checks.
In South Korea, people can block remote account openings and certain loan transactions; companies should first reduce how long they retain identity-document photos once verification is complete.
One-minute news
▶ Personal information from about 6.6 million accounts was leaked from Times Car, a Japanese car-sharing service. About 1.6 million accounts included photos of identity documents, including driver’s licenses.
▶ Applications to replace driver’s licenses are surging in Japan, but police say the change in only part of the license number means reissuing one has limited effect in preventing identity theft.
What happened
Photos of driver’s licenses belonging to people who had canceled their car-sharing subscriptions in Japan were also exposed.
Park24, the parent company of Times Mobility, which operates Times Car, said an outside party gained unauthorized access to its computer systems in September and took information from about 6.6 million accounts. The affected accounts included not only current members, but also former members and people who had started but not completed the sign-up process.
The information exposed varied by account. It included names, addresses, dates of birth, contact details and driver’s license information. Photos of identity documents, including driver’s licenses, were taken from about 1.6 million accounts. The company said credit card information was not exposed.
After the announcement, Japanese police stations and driver’s license centers received a surge of inquiries about replacing licenses. People were concerned that getting a new license might be necessary for their safety if a photo had been exposed. Japanese police, however, say that replacing a license alone is unlikely to prevent identity theft.
Analysis
One point worth examining in this incident is why photos belonging to former members were still being kept. Park24 retained personal information for about seven years after customers canceled their memberships.
The company told Japanese IT publication ITmedia that it did so to meet legal requirements to retain transaction records under tax law. However, tax law does not require companies to keep photos of driver’s licenses for seven years. The company said it retained the photos to prevent impersonation and respond to customer inquiries.
Times Car had also kept photos of former members’ driver’s licenses, and those records were exposed in the hack.
Even when a driver’s license is reissued in Japan, only details such as the final digits of the license number and the photo change. Information that has already been leaked, such as a person’s name and date of birth, remains the same. Because criminals could still try to impersonate victims elsewhere, Japanese police consider stronger identity checks by financial institutions more important than reissuing licenses.
Different perspectives
It is understandable why users want their licenses reissued. When a photo showing their face and license number has fallen into the hands of strangers, they may feel uneasy continuing to use the original license.
Japanese police do allow licenses to be reissued. But getting a new license and preventing impersonation in financial transactions are two separate matters.
There are also differing views on how long information should be retained. Companies need records to review past transactions and handle disputes. Users, meanwhile, may not expect photos of identity documents submitted at sign-up to remain on file after they cancel their memberships.
Implications
The Times Car incident shows that the harm caused by a cyberattack may not end with the company that was hacked. Photos of identity documents stolen from a car-sharing company could be misused to verify someone’s identity on other services. This is also why Japan’s Financial Services Agency has asked financial institutions to check identity-document photos and applicants’ faces more carefully.
This issue is familiar to people in South Korea as well. Users often submit photos of identity documents when using car-sharing, telecommunications, lodging and financial services. The Personal Information Protection Commission received 447 reports of data breaches last year and 432 in the first half of this year alone.
This does not mean that an incident like the Times Car breach has occurred in South Korea. But there is ample reason for companies to review how much personal information they store on their servers and how long they keep it.
The method used in the hack has not yet been made public. It is therefore not possible to identify ransomware or a flaw in a particular security device as the cause. The key lesson is that sensitive information had been retained for a long time.
Solutions
Companies should manage transaction records separately from photos of identity documents. Even when the law requires them to retain transaction records, they should consider whether they need to keep the original photos for the same period.
If retaining photos is unavoidable, companies should clearly define the reason and retention period, then confirm that the files have been deleted from both working systems and backups once that period ends.
Identity verification methods that rely on submitted photos are also changing. Starting next April, Japan’s Financial Services Agency plans to end the practice of submitting images of identity documents for remote identity verification and make reading the information stored on the card’s IC chip the standard method.
This approach takes advantage of the fact that a leaked photo cannot be used to read the chip on a physical card. The agency has asked financial institutions to speed up the transition even before the new rules take effect.
If you in South Korea receive notice that a photo of your identity document has been exposed, first check what information was leaked through the company’s official website or customer service center. You should then watch for unfamiliar financial transactions in your name.
If you are concerned about new transactions, you can use your financial institution’s app or Account Info to apply for “Safe Blocking for Non-face-to-face Account Opening” and “Safe Blocking for Credit Transactions.” The first prevents unwanted remote account openings; the second restricts covered transactions such as loans and card issuance. Since you will need to remove the block when you need those services, it is a good idea to check the scope of the restrictions before applying.