Park24 has settled on the number it hopes will close a bruising chapter: 3,000 yen, roughly $19, for every customer whose identity documents may have left its servers.
The payment covers 1.4648 million records at the car-sharing arm Times Mobility, which runs the Times Car network. The company disclosed the tally on October 23 alongside its quarterly results.
What left the building matters more than the cash. Park24 says investigators found traces that driving-licence photos and other verification images were read and then transmitted out of its systems. The files sat encrypted, so an outsider could not simply open them. Executives still chose to pay because they cannot promise the scrambling holds forever.
The earlier intrusion surfaced on September 25. Three days later the operator confirmed about 6.6 million accounts had been exposed, carrying names, addresses, birth dates, phone numbers, email addresses and licence details. The entry point, per Park24, was a flaw in its web platform.
A deeper sweep found more. Times Club, the loyalty side of the business, also leaked: 135,436 partner-service linkage identifiers, 19,510 card numbers, 28 credit-card last-four digits, 12 business card numbers and five full identity sets.
The bill lands hard. Park24 booked an extraordinary loss near 5.5 billion yen, roughly $36M, cutting its full-year net profit forecast from 44 billion yen to 38.5 billion yen.
It also changed how it stores documents. Verification images will now be deleted once registration finishes, and the archive still on disk goes by the end of October. Until this week, the company held those scans for the membership period plus seven years after a customer quit.
A joint damages suit is already forming. More than 10,000 people registered with a Tokyo lawyer in the first days after the breach went public.
