Times Car Data Breach: 6.6 Million Accounts Exposed — Detection and Response Guidance for Defenders

---
title: Password Spray or Credential Stuffing Against Web Authentication
id: 3b7a2c1d-8e4f-4a5b-9c6d-2e1f0a9b8c7d
status: experimental
description: Detects high-volume failed authentication from a single source targeting many distinct accounts, consistent with credential stuffing using breached credential lists such as those from mass PII breaches.
references:
  - https://attack.mitre.org/techniques/T1110/004/
  - https://www.bleepingcomputer.com/news/security/times-car-confirms-data-breach-affecting-66-million-user-accounts/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1110.004
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventID: 4625
  condition: selection
falsepositives:
  - Misconfigured service accounts
  - Legacy clients retrying expired passwords
level: medium
---
title: Phishing URL Referencing Breach Impersonation Lures
id: 9f2e1d4c-5b6a-4c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects web requests to lookalike domains or URLs using Times Car breach-themed lure keywords, consistent with post-breach phishing campaigns impersonating breach notification or compensation portals.
references:
  - https://attack.mitre.org/techniques/T1566/002/
  - https://www.bleepingcomputer.com/news/security/times-car-confirms-data-breach-affecting-66-million-user-accounts/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: proxy
detection:
  selection_keywords:
    c-uri|contains:
      - 'timescar'
      - 'times-car'
      - 'times_car'
    c-uri|contains:
      - 'verify'
      - 'secure'
      - 'update'
      - 'compensation'
      - 'support'
  filter_legitimate:
    cs-host|contains:
      - 'timescar.jp'
      - 'share.timescar.jp'
      - 'park24.co.jp'
  condition: selection_keywords and not filter_legitimate
falsepositives:
  - Security research or threat intel lookups
level: high
---
title: Anomalous Bulk Database Query Volume by Service Account
id: 1a4b6c8d-2e3f-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects database audit events indicating full-table reads or bulk SELECT operations on customer/account tables by application service accounts, a pattern consistent with mass PII extraction as seen in large consumer-platform breaches.
references:
  - https://attack.mitre.org/techniques/T1213/
  - https://attack.mitre.org/techniques/T1530/
  - https://www.bleepingcomputer.com/news/security/times-car-confirms-data-breach-affecting-66-million-user-accounts/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1213
  - attack.exfiltration
logsource:
  category: database
  product: sqlserver
detection:
  selection:
    statement|contains:
      - 'SELECT * FROM'
      - 'BULK INSERT'
      - 'INTO OUTFILE'
    statement|contains|all:
      - 'customer'
      - 'user'
      - 'member'
      - 'account'
  condition: selection
falsepositives:
  - Scheduled ETL or reporting jobs
  - Legitimate backup/export operations
level: high

// Credential stuffing / password spray detection following mass credential breach
// Looks for single sources failing auth against many distinct accounts, then succeeding
let window = 1h;
SigninLogs
| where TimeGenerated > ago(7d)
| summarize
    FailedCount = countif(ResultType != 0),
    SuccessCount = countif(ResultType == 0),
    DistinctAccounts = dcount(UserPrincipalName),
    Accounts = make_set(UserPrincipalName, 25)
  by IPAddress, AppDisplayName, bin(TimeGenerated, window)
| where DistinctAccounts > 10 and FailedCount > 20
| extend StuffingRatio = round(todouble(FailedCount) / todouble(DistinctAccounts), 2)
| project TimeGenerated, IPAddress, AppDisplayName, DistinctAccounts, FailedCount, SuccessCount, StuffingRatio, Accounts
| sort by DistinctAccounts desc;

// Proxy / web hunt for Times Car impersonation lure traffic (CEF-ingested proxy logs)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("timescar", "times-car", "times_car")
    and RequestURL has_any ("verify", "secure", "update", "compensation", "support", "notice")
    and not(DestinationHostName has_any ("timescar.jp", "park24.co.jp"))
| project TimeGenerated, SourceIP, DestinationHostName, RequestURL, RequestMethod, DeviceAction
| sort by TimeGenerated desc;

// Endpoint hunt: users opening credential-harvest lure attachments or HTML files
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName has_any ("timescar", "times_car", "TimesCAR", "breach_notice", "account_verify")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, FolderPath, SHA256
| sort by TimeGenerated desc;

-- Hunt endpoints for Times Car breach-lure artifacts: downloads and recent execution
SELECT FullPath, Size, Mtime,
       hash(path=FullPath) AS Hash
FROM glob(globs=[
  'C:/Users/*/Downloads/*timescar*',
  'C:/Users/*/Downloads/*Times*Car*',
  'C:/Users/*/Downloads/*verify*account*',
  'C:/Users/*/Downloads/*breach*',
  'C:/Users/*/Downloads/*compensation*'
])
WHERE Mtime > timestamp(epoch=1700000000)
ORDER BY Mtime DESC

-- Correlate with recent process execution from user-writable paths (lure payload execution)
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)Users\\\\.*\\\\(Downloads|AppData|Temp)\\\\'
   OR CommandLine =~ '(?i)(timescar|breach|verify|compensation)'
ORDER BY CreateTime DESC

# Audit MFA coverage and legacy auth exposure — run with read-only Graph scopes first
# Requires: Microsoft.Graph PowerShell module, Connect-MgGraph -Scopes 'User.Read.All','Policy.Read.All','AuditLog.Read.All'

# 1) Find users WITHOUT any strong auth method registered (prime stuffing targets)
$users = Get-MgUser -All -Property 'Id,DisplayName,UserPrincipalName,AccountEnabled'
$report = foreach ($u in $users | Where-Object { $_.AccountEnabled }) {
    $methods = Get-MgUserAuthenticationMethod -UserId $u.Id -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        UserPrincipalName = $u.UserPrincipalName
        MFARegistered     = ($methods.AdditionalProperties.'@odata.type' -join ';') -match 'microsoftAuthenticator|phoneAuthentication|fido2|windowsHello'
        MethodCount       = $methods.Count
    }
}
$report | Where-Object { -not $_.MFARegistered } | Export-Csv -Path '.\users_without_mfa.csv' -NoTypeInformation
Write-Host "Users without MFA: $(($report | Where-Object { -not $_.MFARegistered }).Count) — see users_without_mfa.csv"

# 2) Check for legacy authentication block via Conditional Access policy presence
$policies = Get-MgIdentityConditionalAccessPolicy
$legacyBlock = $policies | Where-Object { $_.Conditions.ClientAppTypes -contains 'other' -or $_.Conditions.ClientAppTypes -contains 'exchangeActiveSync' }
if (-not $legacyBlock) { Write-Warning 'No Conditional Access policy blocking legacy auth detected — create one immediately.' }

# 3) Pull last 24h of risky sign-ins for triage
$start = (Get-Date).AddDays(-1).ToString('yyyy-MM-ddTHH:mm:ssZ')
Get-MgIdentityProtectionRiskySignIn -Filter "createdDateTime ge $start" -All |
    Select-Object UserPrincipalName, IpAddress, RiskLevel, RiskDetail, CreatedDateTime |
    Export-Csv -Path '.\risky_signins_24h.csv' -NoTypeInformation
Write-Host 'Exported risky_signins_24h.csv for SOC triage.'

#!/bin/bash
# Linux/web-tier audit: detect bulk egress anomalies and exposed database listeners
# Run on web/app servers and DB hosts during breach self-assessment

# 1) Any database listeners reachable beyond localhost? (MySQL/Postgres/Mongo/Redis)
echo "=== Listening DB ports ==="
ss -tlnp | grep -E ':(3306|5432|27017|6379|1433)\b'

# 2) Top egress talkers in last 24h (requires netflow/nethogs history or use conntrack snapshot)
echo "=== Current high-volume outbound connections ==="
ss -tnp state established | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -20

# 3) Web server access log: burst requests from single IPs (potential enumeration/scraping)
echo "=== Top requestors today (adjust log path) ==="
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20

# 4) Large response bodies — possible bulk data export via web layer
echo "=== Responses > 5MB today ==="
awk '$10 > 5000000 {print $1, $7, $10}' /var/log/nginx/access.log | head -50

# 5) Recent archive/compression of data directories (staging for exfil)
echo "=== Recently created archives ==="
find /var /tmp /home /opt -type f \( -name '*.tar.gz' -o -name '*.zip' -o -name '*.7z' -o -name '*.sql' -o -name '*.csv' \) -mtime -7 -size +10M 2>/dev/null