Recruit Carsensor.net and C-MATCH Breach (Up to 3,709,551 Records): Names and Addresses of People Who Contacted Dealers May Be Exposed — What Users and Dealers Should Do

The company warns that suspicious contacts misusing the data may arrive, and asks people not to open emails, text messages or letters or answer calls, not to open links in them, and not to open attachments.

Most of the records contain only name and address, so correctly addressed letters deserve more caution than emails or phone calls. The basics of spotting fakes are in what phishing is.

The company says it will contact affected people individually in turn. That means genuine and fake contacts will arrive around the same time.

Even if a letter or email offers "compensation for the incident", a "refund" or a "reward for a survey" (examples from this site), do not use the phone numbers, URLs or QR codes in it. Open Recruit's notice page yourself through a search and follow the contact listed there.

Inquiry content is included in 33,247 and 799 of the records. In general, a contact that names the model or the dealer you asked about looks convincing.

Even if a contact claims to be the dealer, knowing what you asked about proves nothing. Do not answer on the spot; look up the dealer's number yourself and call back.

The company says login passwords are not included and has not asked anyone to change passwords.

Separately, if you use the same password on several services, this is a good time to make them different. This is general advice from this site, not guidance from the company. A password manager helps keep track.

Send questions to the dedicated inquiry desk listed on the notice page (an email inquiry through Recruit's help page).

If you paid money or gave card details after a suspicious contact, also contact your card company or bank, and the police consultation line (#9110 in Japan).

The dealer items include the names and phone numbers of representatives and staff, and login IDs. The company says login passwords are not included.

In general, a login ID plus a staff name makes it possible to create fake contacts asking for a password while posing as the service operator. If you receive a contact about "logging in again after the service resumes" or "checking your account" (examples from this site), do not enter anything through its links; open the service from a bookmark or official guidance.

For sole proprietors, direct-debit bank account information is also listed. The Japanese Bankers Association warns about people who pose as bank staff to get account details or PINs (a general warning, not one about this incident).

If you receive a contact saying "a debit failed" or "your account needs checking", do not use the numbers or URLs in it; check with your bank or the company's official contact yourself. If you see a debit you do not recognise, contact your bank straight away. How to think about leaked bank details is also covered in the Lashinbang article.

Staff names and phone numbers are among the items. In general, a call or email that names a member of staff tends to be treated as genuine inside a business.

Agree within the business that if a contact claiming to be C-MATCH or Carsensor asks to change payment details or for login information, staff will not act on it straight away and will check through another route.

The company said addresses of people who contacted dealers are in principle only to city level, while giving up to 447,670 records that may include a street-level address.

In general, even if a form is designed to collect only the city, free-text fields and older data formats can hold more detail than the design intends. Checking stored items against the actual data rather than the design documents lets you state quickly and accurately what is in scope if a leak happens.

Data on users, partners, employees and contractors each has a different purpose and retention need. In general, related systems built around one service tend to collect a little of each.

For each system, list which groups' data it holds, which items, and for how long, and decide whether inquiries that have already been passed on can be removed from day-to-day screens. If groups and items are kept separate, it is easier to answer "am I affected?" on the day of an incident.

Most people in scope here have only a name and address on record, not an email address or phone number. In general, the ways to reach such people individually are limited, and genuine and fake contacts arrive around the same time.

Before an incident happens, decide which channels and senders you use for important notices and what you will never ask for, and publish them on your official website. That helps people tell real from fake. For email sender spoofing protection, see SPF, DKIM and DMARC against spoofed email.