Park24 Discloses Data Breach Affecting 6.6 Million Accounts

Park24 disclosed a significant cybersecurity incident impacting approximately 6.6 million accounts across its car-sharing and business services, a development highlighting the growing threat landscape for companies managing extensive customer data. The breach, detected on September 25th, 2026, affected Times Mobility, a Park24 subsidiary, and resulted in the unauthorized access and potential theft of personal information.

The compromised data includes a wide range of personally identifiable information (PII), encompassing names, addresses, birthdates, phone numbers, email addresses, driver’s license details, and images of identification documents. While credit card information was reportedly not affected and passwords were stored in an unrecoverable format, the sheer volume and sensitivity of the leaked data pose a substantial risk to affected individuals. The breach impacts both current and former members of Times Car and Times Business Services.

Park24 immediately took steps to contain the breach, blocking the intrusion route by September 26th and verifying that access through that route had been terminated. The company has initiated a forensic investigation with external specialists and has notified the Personal Information Protection Commission and law enforcement authorities. A full accounting of the incident's cause and scope is underway, with commitments to publicly disclose further details as they emerge.

While the company claims no current impact to service provision, the incident is likely to trigger increased scrutiny of Park24’s cybersecurity protocols. The filing notes that the impact on financial performance is still under assessment, but the potential for regulatory fines, legal claims, and reputational damage represents a material risk. The incident occurs against a backdrop of escalating global cybersecurity threats, with recent activity from hacker groups and state-sponsored attacks increasing the pressure on organizations to protect sensitive data.

The company has not yet detailed its comprehensive plan to prevent future breaches, indicating a forthcoming announcement with both immediate and long-term preventative measures. The incident serves as a stark reminder of the financial and operational repercussions that can arise from data security failures, particularly for companies operating in the increasingly digital mobility sector.