Recruit has pulled its used car marketplace offline after intrusion tools reached systems behind it, and the shutdown has spread to three automakers’ own sales channels.
The company said on October 21 that records for as many as 3,709,551 people may have been exposed through Carsensor net and C-Match, the back-office tool dealers use to manage listings and enquiries. Suspicious traffic was first detected on October 17, and every related service was halted that afternoon.
The biggest bucket covers 3,210,421 people who submitted enquiries to dealerships through Carsensor net. Names and addresses are involved, with full street-level detail possible for up to 447,670 of them. Another 483,168 records belong to dealer principals and staff on C-Match, and include trade licence numbers and, for sole traders, bank account details for direct debits. Roughly 10,700 employee and contractor records are also in scope. Recruit says card data and passwords were not held in the affected systems.
The outage travelled downstream. Nissan and Mitsubishi Motors suspended their factory used-car search sites from October 17 because both run on Recruit systems. Mazda kept its own site live but lost the ability to add or delete stock shared with Carsensor. At the October 20 close, none of the three had a restoration date.
The wider toll is a chokepoint problem. Carsensor listed about 520,000 vehicles in September, and dealers who depend on it for enquiries have been pointing customers at their own pages or rival portal Goo-net instead.
Recruit notified Japan’s Personal Information Protection Commission and says no secondary harm has been confirmed so far. It is warning affected users not to open unexpected mail, links or attachments, and has set up a dedicated enquiry desk.
