After the disclosure of 6.6 million car rental accounts in Japan: FSA promoted IC chip identification and corporate liability was tested

The Japanese Government sent a reminder to various sectors and enterprises on October 9 to enhance cyber-protection. The alert was based on the issue of data security for successive disclosure by multiple agencies: the convenience store enterprise Lawson, Daiwa Security, the second-hand link BookOff and the car sharing and leasing service Times Car were the subject of public attention. They are not the same case and there is no public evidence that they were carried out by the same attack group.

Group I risks: driver ' s licence photographs, identification information and millions of client accounts

The incident in Times Car involved some 6.6 million account data, and concerns were raised about potential leakages from sensitive categories such as personal identification, driver's licence information and contact information. For rental platforms, the driver ' s licence document has an impostor value higher than general marketing information: the enterprise must specify how long the original document is kept, who has access to it, when unauthorized data is discovered and how to notify the potential affected users.

Large and large securities involving securities institutions have different risk patterns than those of ordinary retail enterprises. Financial accounts, identity checks and access to third-party suppliers require separate answers for information disclosure. Public disclosure by companies does not show the same scale of data leakage; One of the accounts, which involved 6.6 million accounts, could not be directly applied to other enterprises.

Group II risks: supply chain and counterfeit security services

Japan ' s new national cyber security agency requires government departments to communicate recommendations to local governments and private enterprises for enhanced identification, system upgrading and supply chain management. The attackers may have disguised as security service personnel, using the post-incident tension of the business and the user to commit double fraud; While the AI tool makes bulk-production of fishing mail and automated detection easier, not every leak in Japan has been triggered by AI.

Indicators that would truly test the effects of the modifications include the multiple-factor authentication coverage of high-authorization accounts, the time of retention of identity materials, the third-party access list, the gap repair window and delays in the notification of incidents. Government risk communication, if not followed up, would only be a formal document before the next leak.

JFA changed the way it checked the identification: the more centralized the image, the greater the risk of forgery

On 9 October, the Financial Services Agency of Japan issued a circular to financial institutions requesting enhanced management of outsourced services and accident response, and special checks on the anomalies of identity documents and face photographs during remote openings. The circular also states that, as of 1 April 2027, the relevant identification system will be converted in principle to IC chip access and eliminate the mere receipt of document images; Financial institutions are required to adjust at the earliest opportunity, rather than waiting for the statutory period.

The Japan Information Processing Promotion Agency (IPA) also issued a warning on the same day to enterprises with large customer information to include unauthorized access and identity information in company risk management at the business level, rather than to refer it to the technical sector alone. Business choices made by business executives in expanding the size of users and centralizing the storage of identity documents must ultimately be monitored in conjunction with data protection obligations.

Who bears the cost of misuse of the user identity after successive leaks

Once the driving licence, address, identification and financial account information enters the black market, the risk may last for several years. Businesses emphasize that investigations are ongoing and do not substitute for active notification, the provision of identity protection, the removal of information that is no longer necessary and the cost of remediation. The personal information protection system and industry regulatory bodies in Japan must provide victims with clear channels of complaint, rather than leaving clients alone to bear the consequences of the fraudulent use of their identities after the disclosure.

From the rental of a platform to the securities provider, successive data security incidents have exposed common weaknesses among Japanese enterprises: the more business expansion relies on outsourced platforms and centralized databases, the more people are required to be truly responsible for the duration of identity data and access. Governments can issue warnings and regulators can demand corrective action; But ultimately, if only the user changes the document, the password and the risk of fraud, the cost of the accident is transferred to the person with the least control.