Times Car reporting ¥5.5 billion loss has firms bracing for data breach fallout

As cyberattacks continue across Japan, companies are coming to realize the great financial risk of such attacks if their lax cybersecurity systems cause millions of peoples’ personal information to be leaked.

Times Car, which saw personal data that included the driver’s licenses of 1.46 million people leaked in September, is learning the lesson the hard way.

Last week, Park24, the parent of Times Car operator Times Mobility, announced that it plans to report a one-time special loss of ¥5.5 billion (about $35 million) for the business year through October over the incident.

The cost covers a blanket ¥3,000 payout the company is planning to give to each customer whose driver’s license data and other critical information have been breached, along with the costs to deal with the incident.

“This case shows how much financial damage smaller companies could face as a result of personal data leaks,” said Junko Kawai, a lawyer at Umegae Chuo Legal Profession.

“Some companies could see their reputations suffer, and they could struggle to stay in business, face financial difficulties and ultimately go bankrupt,” she said.

The car-sharing service is now facing a class-action lawsuit that could bring further financial cost to the company for failing to protect customers’ data.

Kawai said that while large companies like Times Car could recover from both the reputational and financial impact of such a lawsuit, such costs — even if adjusted — could be debilitating for smaller businesses.

Speaking on Monday, Yuki Makino of Makino Law Office in Tokyo said the suit to be filed later this year would seek ¥50,000 in damages for each person who had images leaked of their personal IDs, such as driver’s licenses, and ¥30,000 for other users who were affected by the breach.

Yuki Makino, lawyers of the plaintiffs planning to file a class action lawsuit against operator of Times rental car service, speaks in a news conference on Monday in Tokyo. | JIJI

More than 100,000 people have reportedly registered as claimants on the firm’s website. If a court grants the full amount to the claimants, Times Mobility could face somewhere between ¥3 billion to ¥5 billion in losses.

In a more severe case than the Times Car leak, major technology company GMO Internet Group was targeted by a hackers’ group demanding a ransom earlier this month. The company promptly offered two tiers of compensation for their customers.

GMO said Wednesday it would pay up to ¥3 million per public leak of information, but otherwise it would offer ¥5,000 to all of its users — a figure similar to the original compensation Park24 suggested. The company also said it will pay up to $1 million for any crucial information that leads to catching the hackers.

Historically, most payouts to those affected by data leaks have also been closer to Park24’s initial proposal of ¥3,000 than the compensation the lawsuit is seeking.

In 2004, SoftBank gave ¥500 gift certificates to millions of users of its Yahoo! BB internet service after the information of over 4.5 million users was leaked.

When Benesse offered ¥500 vouchers after tens of millions of customer records were leaked in 2014, a class-action lawsuit was filed seeking ¥55,000 per person. Ultimately, a court ordered Benesse to pay ¥3,300 to each individual.

Reflecting on the Times Car lawsuit, Akira Watanabe, a partner at the law firm Nakamura and Partners, predicted that the suit will be successful but said the compensation will likely amount to less than Makino’s target.

Given that it is not yet clear how a third party managed to access the data on Times Car’s system, it may be difficult to prove liability, Watanabe said.

However, the lawsuit may encourage other firms to delete unnecessary personal data going forward.

“Many other companies should take this case seriously,” said Watanabe.