2026 Recruit — Car Sensor net and C-MATCH dealer support service; unauthorised access by a third party; up to 3,709,551 personal records may have leaked
Data compromised
About 3.2 million Car Sensor net users who contacted dealerships. About 483,168 dealers registered on C-MATCH: representative and contact names, phone numbers, used-goods dealer licence details and login IDs. For sole proprietors, office addresses and bank withdrawal account information. Card payment information is reported as not included.
Technical writeup
Figures are from Japanese press reports of Recruit’s October 21 announcement. The original release was not retrieved, so the breakdown should be checked against it. “Up to” means the count is a ceiling, not a confirmed total. No misuse had been confirmed at the time of reporting. recordsAffected uses the ceiling figure and should be revised once Recruit publishes a confirmed count.
Root cause
Unauthorised access by a third party, detected on October 17, 2026. Related services were suspended from about 5:00 p.m. that day. Recruit has not named the vulnerability, the attacker or the entry point.