Teollimi

Recruit (Carsensor.net / C-MATCH) data breach

Was I affected?

Recruit (Carsensor.net / C-MATCH) confirmed a breach involving up to 3.7 million records (duplicates possible), exposing names, addresses, phone numbers and email addresses. You may be affected if you contacted a used-car dealer or posted a review through Carsensor.net or its app in Japan, or if your dealership uses C-MATCH.

Recruit (Carsensor.net / C-MATCH) breach facts
AnnouncedOct 21, 2026
When it happenedSuspicious access detected October 17, 2026
CountryJapan
Records exposed (may include duplicates)3.7 million
Data exposedNames, Addresses, Phone numbers, Email addresses, Bank or financial details and Other details
StatusConfirmed by the company or a regulator filing

What happened

Recruit said on October 21, 2026 that outsiders accessed systems behind Carsensor.net, Japan's used-car listing site and app, and C-MATCH, its back-office service for used-car dealers, and that up to 3,709,551 records of personal information may have leaked. It detected the suspicious access on October 17 and suspended Carsensor.net, the Carsensor app and C-MATCH the same day. Most of the records (up to 3,210,421) belong to people who sent inquiries to dealers through Carsensor.net and mainly contain names and addresses, usually only down to the city or ward; a small number also include inquiry details, phone numbers or email addresses. The rest cover reviewers, about 483,000 dealers registered on C-MATCH (contact details, license numbers and login IDs, plus bank debit accounts for sole proprietors) and about 10,700 staff and contractors. Recruit says no payment card information or login passwords were included, and Nissan and Mitsubishi Motors paused their own used-car search sites, which use Recruit's system.

What should I do?

  1. Expect emails, texts or calls that mention a car you asked about; don't open links or attachments in messages you did not expect, as Recruit has warned.
  2. If you run a dealership on C-MATCH as a sole proprietor, watch the bank account used for C-MATCH debits and tell your bank about anything you don't recognize.
  3. Check Recruit's official notice or wait for its individual notice rather than replying to messages that claim to be from Carsensor.
  4. Be wary of callers who know your name and area and offer car deals or ask for payment.
XRedditWhatsApp

More data breaches in Japan →

Check the other services you use →

Sources