Park24 announced on October 23 that it would provide cash or gift certificates equivalent to ¥3,000 to some users following unauthorized access to Times CAR's web system. This compensation targets users for whom traces of access and external transmission were confirmed regarding encrypted identification document images, such as driver's licenses.
The company detected unusual access on September 25 and subsequently isolated the system and blocked intrusion routes. Subsequent investigations confirmed traces of external transmission for 1,464,800 identification document images. Separately, for 891,602 items, while traces of access by attackers were found, no traces of external transmission were confirmed.
Since the images were stored encrypted, even if they were transmitted externally, their contents were not immediately readable. However, the company stated that the possibility of decryption cannot be entirely ruled out and thus decided to offer the compensation.
The company is also reviewing its storage rules for identification documents. Previously, images were retained for the duration of membership plus seven years after withdrawal, but going forward, the policy will change to not retain them after membership registration is complete. Currently held images will also be deleted by the end of October, regardless of whether the individual requests it. However, information necessary to confirm identity against past images for inquiry responses, etc., will be preserved.
Necessary countermeasures have been implemented for the web system vulnerability that caused the intrusion. The company states that, to the extent it can confirm, it has no knowledge of the leaked information being sold or published.
Made with AI
