Baitoru breach (up to 3.88 million email addresses): only emails leaked — how members can spot fake interview messages and job scams

The company says it told affected members on Baitoru and Baitoru NEXT on October 6, 2026, and is contacting them individually by email and other means. No way for members to check for themselves has been published.

Because people know an email from the company is coming, fake emails imitating it are possible. To check, do not use a link in an email; open the site from the official app on your home screen or your own bookmark and read the notices there.

On a job site, it is normal to get messages from employers about interview times or confirming an application. That is exactly why messages imitating them are hard to tell apart.

For any such message, check in the official app or site whether you really applied for that job and whether the listing still exists. If you do not remember applying, or the listing cannot be found, ignore the message without opening the link (the basics: What is phishing?).

Per the company's notice, passwords and credit card details were not among the leaked data. The company also says it never asks for passwords or credit card details by email or other messages.

So a message asking you to type a password or card number "to verify your identity" or "to protect your account" is fake. If you already entered one, change the password right away from the official app, and change it on any other service where you used the same password (how to check whether a password leaked).

This is general advice about job sites, not a statement about Baitoru. Japan's National Police Agency warns that even listings on legitimate job sites can include harmful ones that recruit people for crimes, such as collecting cash for phone scams. Signs it lists include being told to install a highly anonymous messaging app, being asked repeatedly for personal details about you, your family or friends, and being unable to confirm the workplace or the job content.

The agency says legitimate part-time jobs do not need such apps, and asks people who get these requests to stop responding and consult the police. If you already sent a photo of an ID document, see what to do if your Japanese driver's license data was leaked.

The National Police Agency lists, as signs of recruitment for crimes (known in Japan as yami baito), postings that promise high pay without a clear job description, phrases such as "high pay", "paid the same day" and "white (clean) job", and offers of high pay just for carrying or receiving packages.

If you have already applied and cannot get out, the agency asks you to call the police consultation line #9110 or go to a nearby police station.

Japan's National Consumer Affairs Center warns of side jobs that promise easy money for simple tasks in spare time but end with people paying money instead. Most start from social media or ads, and some involve applying through a messaging app.

If you are asked to send money for work that was supposed to pay you, call the consumer hotline 188 before paying.

Write down every screen or API that returns member data such as email addresses, every function that says whether an account exists (sign-up, password reset, login), and every function where a number selects someone's data. For each one, check that the server checks every time whether this user may see that record (the idea: authentication vs authorization).

Count not only requests but the number of other people's records returned, per logged-in account or API key. Measure what normal use needs, set the cap from that, and start by alerting someone when usage reaches 80% of it. IP addresses can be changed, so count by account or key. The full design is in rate limiting and abuse control.

In access logs, look for one user querying sequential IDs or similar-looking email addresses in rapid succession. People clicking through screens do not produce that pattern, so requests per hour and the number of distinct targets queried are good signals.

The company says that right after confirming the access it blocked all access from overseas and also modified the program. Blocking by country works quickly as a first response to stop damage. But in general it depends on how the connection's origin appears, so on its own it leaves the problem in the function. Use the time it buys to add per-record permission checks and volume caps to the function itself; that is the real fix.