Japan Leaked 1.6 Million Driver's License Photos. What AI Changes

Japan just leaked about 1.6 million photos of driver's licenses. And in the age of AI, a photo of your ID is exactly what a scammer wants.

I've run a web platform in Tokyo for 22 years. Keeping member data safe is the part of my job that keeps me up at night. So I read every official notice from the company in Japanese, all five of them, and the bank announcements that followed. I made a video about it too. This article has the numbers the video couldn't hold: the final count, how long the photos were kept, which banks stopped accepting ID photos and when, and how the chip check actually works.

The short version

• Times Car, one of Japan's biggest car-sharing services, detected an attack on September 25, 2026.
• The final report says the attacker took personal data from 6,628,007 accounts, and sent out encrypted ID image data for 1,464,800 of them. Another 891,602 were accessed but not sent out.
• The company kept ID photos for as long as you were a member, and for 7 years after you left. That's why people who closed their accounts were hit.
• Japan's financial regulator asked banks on October 9 to stop relying on ID photos and read the IC chip instead. Within two weeks, several of the biggest banks stopped accepting ID photos for opening accounts online.
• If you run a service: check the ID, keep the result, delete the image. Times Car has now switched to exactly that rule.

What leaked at Times Car

Times Car is run by Times Mobility, part of Park24. The company published five notices between September 25 and October 23. Here is the timeline from its final report.

Date	What happened
Sep 25	Unusual access detected at 9:07 a.m. Servers isolated, forensic investigation started, regulator notified, first notice published
Sep 26	Affected systems cut off by 7:25 a.m.
Sep 28	Police consulted. About 6.6 million accounts reported as leaked
Sep 29	About 1.6 million accounts with ID images reported
Oct 1	Notices sent to former members
Oct 16	New rule: ID images deleted right after registration. All stored images to be deleted by the end of October
Oct 23	Forensic investigation finished. Final numbers published

And the final numbers:

What	Accounts
Name, address, date of birth, phone, email, driver's license details: accessed and sent out	6,628,007
ID image data (encrypted): accessed and sent out	1,464,800
ID image data (encrypted): accessed, no trace of being sent out	891,602
Passwords (hashed): accessed and sent out	4
Credit card numbers	Not stored by the company, so not leaked

The ID images were not only driver's licenses. They also included proof of address (utility bills, for example), student IDs for the student plan, and family documents for the family plan.

Two details matter here.

First, the images were stored encrypted. The company says that does not mean the pictures could be viewed right away. It also says it "cannot completely rule out" that the stolen encrypted data could be decrypted in the future.

Second, the cause. The company says the attacker used a vulnerability in the web system, got in, searched around inside, and used what it found to reach the database and the file storage. It did not publish more detail.

The company will pay ¥3,000 (about $19) in cash or vouchers to each person whose ID image data shows traces of being sent out.

The part that got me: former members

Here is the rule the company had, from its own notice.

	Before	Now
Current members	ID image kept for the whole membership	Deleted right after registration is checked
Former members	ID image kept for 7 years after leaving	No longer kept

The company said it kept the images for checking suspected fraud, answering questions and other identity checks.

So the people who did the right thing, who closed an account they didn't use, still had their license photo on the server. They left. Their license photo stayed.

Let me make this real. Picture a guy in Osaka. Let's call him Kenji. He's not a real person. Three years ago, he used a car-share twice to move apartments. Then he deleted the app and forgot about it. This month, Kenji's name, address, birthday, phone number and the photo of his face on his license may be sitting in a criminal's folder. Kenji did nothing wrong. He moved apartments.

Think about why those images exist at all. To rent a car with an app, you photograph your license and upload it. Everyone did. I would have too.

Not just one company

Times Car is the biggest story, but it's part of a wave.

Lawson, one of Japan's big three convenience store chains, announced on October 8 that its Lawson ID service had been accessed between September 12 and 14. 2,155,345 Lawson ID records leaked. Mostly names and email addresses. People who had entered more for prize draws also lost their gender, phone number and address. A separate preorder service leaked 26 records, including part of the card number.

Names and emails sound harmless. But a name and an email is exactly what someone needs to send you a very convincing fake email: "Dear Kenji, your account has been compromised. Click here." Lawson itself published the two email addresses it sends its real notices from, so customers could tell the difference.

Trend Micro, a Japanese security company, counts disclosed incidents in Japan:

Period	Disclosed incidents
All of 2025	593
January to September 2026	600
September 2026 alone	86

Its incident response team describes a pattern it keeps seeing in recent cases: attackers use a known vulnerability in a public web application, plant a web shell on the server, then try to raise their privileges, move sideways, and reach the database.

This month, one attack on a cloud company called IDC Frontier hit 495 companies and local governments at once.

And one story that went the other way. JR East, the railway that runs Tokyo's trains, first said up to 2.06 million customer records might have leaked. Later, it said it had checked and nothing leaked. The first story went around the world. The correction barely did.

Why an ID photo matters more now

Opening a bank account online in Japan has usually worked like this: upload a photo of your ID, then take a selfie, and a system checks that the faces match.

Japan relied on this more than most countries. Almost everyone here has a driver's license, and almost everyone has a phone camera.

Now AI can edit a photo, or make a face that never existed, in seconds. Give it a real license photo, with a real name and a real address, and it has a very good head start.

Is AI behind the attacks themselves? Honestly, nobody has proven that. Trend Micro says it has not confirmed any link between the recent incidents in Japan and attackers using AI. What it does say is that AI speeds up scouting and vulnerability analysis, writes convincing phishing emails, and weakens the protection Japan used to get from its language.

And one of Trend Micro's six recommendations for companies is exactly this one: review any process that relies only on uploading a photo of an ID, and move to stronger methods like the IC chip.

Japan's answer: read the chip

On October 9, Japan's Financial Services Agency asked banks to move to IC chip checks as soon as possible. That was already the plan from April 1, 2027, when the rules for opening accounts change. The leak pulled it forward. A senior official told the Nikkan Kogyo newspaper that the methods "are getting more sophisticated," and the paper gave AI as the example.

Here is what the banks did, from a comparison of 24 companies as of October 23.

Company	What changed	When
Sumitomo Mitsui Trust Bank	Ended photo checks for opening accounts remotely (reported)	March 2026
MUFG Bank	IC chip reading required in its account opening app	May 29
docomo SMTB Net Bank	Ended photo checks for personal accounts	September 28
Iwate Bank	Ended photo checks at its digital branch	October 16
Mizuho Bank	Ended photo checks for opening accounts on a phone (reported)	October 19
Hyakugo Bank	Stopped card photo checks in its phone banking	October 22
Sumitomo Mitsui Banking	Stopped accepting ID image uploads online	October 23
SBI Shinsei Bank	Photo checks end, IC chip in the app becomes the standard	October 27
Aozora Bank	Photo checks end in its web account service, My Number card only	October 28
Kyoto Bank	New accounts in its app move to My Number card	November 2 (planned)
PayPay (payments app)	Photo checks end, IC chip reading only	By early November

Two cautions from the same comparison. Some banks added the chip check but still offer the photo method too. "Has the chip" and "stopped taking photos" are not the same thing. And a driver's license still works in many places. What's ending is the photo of the card, not the card.

PayPay alone says more than 44 million people had completed its identity check as of September 2026. That's the scale of what moves when one app changes its rule.

How the chip check works

A photo is just pixels. Anyone can copy it.

The chip in a passport or a Japanese My Number card holds data signed by the government. You tap the card on the back of your phone, the app reads the chip, and it can tell whether the data is real. Japanese driver's licenses with a chip can be read the same way, and several banks and PayPay accept them.

What you need, from the banks' and PayPay's own guidance:

Card	What you enter
Driver's license with a chip	Two 4-digit PINs
My Number card (signature certificate)	A PIN of 6 to 16 characters

PayPay says the My Number card method can finish in as little as 2 minutes.

Notice what Japan's answer is. It isn't more AI to catch the fakes. It's a chip that a fake photo can't copy. I think that's the right call. When a copy becomes cheap, stop treating copies as proof.

And from April 2027, Japan plans to end photo-based ID checks for opening accounts altogether.

This isn't only about Japan

Maybe you've never been to Japan. It doesn't matter.

I used to live in Australia. In 2023, a lender there called Latitude lost around 7.9 million driver's licence numbers. Same story, different country.

Think about how many apps have a photo of your license. A crypto exchange. A bank app. A car rental. A delivery job. A dating app that wanted a blue check. Every one of those photos is sitting on somebody's server. Times Car's was too.

3 things I changed this week

Here's what I'm doing, as someone who runs a service and uses a lot of them.

One. When an app offers the chip, I choose the chip. If it can read my passport or ID card instead of taking a photo, I use that.

Two. Every few months, I list which services still have my ID, and I close the accounts I don't use. I lived abroad for 12 years, from 2011 to 2023. I've handed my passport to more apps and hotels than I can count. When I actually made the list, it was longer than I expected. And closing the account is not always enough. Times Car kept images for 7 years after people left. If a service lets you ask for your ID image to be deleted, ask.

Three. If I get an email saying my data was leaked, I don't click the link in it. In Japan, fake breach notices started showing up right after the real ones. I go to the company's website myself, and check the sender addresses they publish, like Lawson did.

If you run a service

On my own platform, the rule is simple. If we don't need to keep a copy of your ID, we don't keep it. If we do need to check it, we check it, keep the result, and delete the image.

A check mark can't be stolen and used to open a bank account. A photo can.

Times Car has now moved to the same rule: delete the image right after registration is checked. It says it keeps only the information needed to confirm later that a document matches the one it saw. An executive at TRUSTDOCK, a Japanese identity check company, told Nikkan Kogyo that how companies store this data "varies widely," and that storage is the next thing that has to get stronger.

If you run any kind of service, here's the short checklist I'd go through this week:

• Do we store ID images at all? Where, and how many?
• Do we delete them after the check, or keep them "just in case"?
• Do we delete them when someone closes their account?
• Can we read the chip instead of taking a photo?
• If we leak tomorrow, can we tell customers the exact email address our real notices come from?

In Japan, a photo of your license used to prove who you are. Now it only proves that somebody has a copy.

Sources: Times Mobility's notices on the Times Car breach, reports 1 to 5 (September 25 to October 23, 2026), and ScanNetSecurity (October 2, 2026). @IT on the Lawson ID breach (October 16, 2026). Trend Micro press release (October 13, 2026). Nikkan Kogyo via Newswitch on the FSA request and the move to IC chips (October 15, 2026). The comparison of 24 banks and PayPay as of October 23, 2026 (rocket-boys.co.jp). Impress Watch on JR East (October 9, 2026). IDC Frontier's own notices for the 495 affected organizations. All based on official notices and Japanese reporting as of October 30, 2026. "Kenji" is a fictional example. Pictures are illustrations, not photos.