Park24 cuts full-year net profit forecast 12.5% on expected ¥5.5bn breach-related loss

Park24 on 23 October 2026 cut its consolidated forecast for profit attributable to owners of parent for the year ending 31 October 2026 by 12.5% to ¥38.5 billion, from the ¥44.0 billion it forecast on 15 June 2026, according to its notice. It said it expects to record a ¥5.5 billion extraordinary loss in its fourth quarter, from 1 August to 31 October 2026. Forecast profit per share falls to ¥225.54 from ¥257.76.

The company kept its other forecasts for the year: net sales of ¥411 billion, operating profit of ¥42.5 billion and recurring profit of ¥39.5 billion, and its annual dividend forecast of ¥65 per share is unchanged from 15 December 2025. Park24 said membership trends in the mobility business saw some impact right after the incident was announced, but daily sales have remained at pre-incident levels.

Park24 said the expected loss covers its response costs and consolation payments linked to "the breach of personal information caused by unauthorized access by a third party". The payments go to customers whose encrypted driver's licence and other ID images, the company said, showed traces of access and external transmission. In a separate notice the same day, it said those customers will receive ¥3,000 each in cash or cash-equivalent vouchers, with details still under consideration. The notices do not split the ¥5.5 billion between the two items.

Park24 said it detected abnormal access to the web system of Times CAR, the car-sharing service run by its consolidated subsidiary Times Mobility Co., Ltd., on 25 September 2026. An external specialist's forensic investigation was completed on 23 October 2026, according to the company. Park24 said the incident was caused by the exploitation of a vulnerability in the web system, and that it would not disclose details of the attack method or system configuration, to prevent secondary damage. It said its Times Club web system had also been accessed without authorisation in connection with the incident.

The company had earlier said about 1.60 million identity document images might have been breached; it now says about 1.46 million showed traces of external transmission. Park24 said the images were stored encrypted, so such traces do not in themselves mean the contents became immediately viewable, although future decryption cannot be completely ruled out. It said that at this time it had identified no facts indicating that the breached data had been sold or made public.

Park24 said it will delete all ID document images it holds by the end of October 2026 and stop keeping them once membership registration is complete, and that a committee centred on its outside directors, with external experts, will look at the group's internal controls and governance in light of the incident. Park24 also said it aims to announce security and governance measures by the end of 2026.