2026-10-22
Recruit Carsensor.net and C-MATCH Breach (Up to 3,709,551 Records): Names and Addresses of People Who Contacted Dealers May Be Exposed — What Users and Dealers Should Do
On October 21, 2026, Recruit Co., Ltd. announced that information on users and business partners of Carsensor.net, its used-car listings site (including the app), and C-MATCH, its business support service for used-car dealers, may have leaked outside as a result of unauthorized access. According to the company, it detected suspicious access from outside to Carsensor.net-related systems on October 17 and suspended all related services from around 17:00 that day. On October 20 it identified the items and the number (maximum) of personal data records that may have leaked. The count is up to 3,709,551 records: 3,210,421 for people who contacted dealers through the site (mostly name and address; addresses are in principle only down to the city or municipality), 5,289 for people who posted reviews, 483,168 for dealers registered with C-MATCH (staff names and phone numbers, secondhand dealer licence numbers, login IDs and so on; for sole proprietors, also direct-debit bank account information), and 10,673 for company employees and staff of contractors and sales agents. None include payment data such as credit cards, or login passwords. The cause is unauthorized access by a third party, with details under investigation. The company has filed a preliminary report with Japan's Personal Information Protection Commission and will contact affected people individually in turn. As of October 21 no secondary harm had been confirmed. Services have been resuming in stages from around 13:00 on October 22, starting with those whose safety has been confirmed. This site's take: anyone who contacted a dealer through Carsensor should assume letters, emails and calls may come from someone who knows their name and address, should not open links or attachments in unexpected contacts, and should check through Recruit's notice page.