[Investigating][Severity: Critical][Intrusion]

Recruit: unauthorized access to Carsensor.net and C-MATCH

Recruit detected suspicious access to Carsensor.net systems on October 17 and stopped related services from about 17:00. Up to 3,709,551 records may have leaked: 3,210,421 inquiries, 5,289 review-writer records, 483,168 C-MATCH dealership/contact records, and 10,673 staff and contractor records. Alongside names and addresses, some records include login IDs; sole-proprietor dealership records include bank debit-account details. Card data and login passwords are excluded. The dealership-related figure is a record count, not a count of separate companies.

Disclosed

2026-10-21

Organizations involved

Leaked or at risk

3.7M

3,709,551

Downtime

Unknown

Timeline

Detected 2026-10-17
Disclosed 2026-10-21
4 days

Attack or cause

Method: [Intrusion]
Impact: [Data leak][Service outage]
Entry point: Unknown

Data exposed or at risk

[Name][Postal address][Phone number][E-mail address][Gender][Bank account][Passwords]

Services hit

Service	Role	Impact level	Note
C-MATCH	[Breached]	[Critical]
Carsensor.net	[Breached]	[Critical]

Organizations involved

[Breached][Critical]Tokyo, ChiyodaInformation and communications
Recruit Co., Ltd.

						Note
Recruit Co., Ltd.	[Breached]	[Critical]	Tokyo, Chiyoda	Information and communications	Unknown

Open in organization search

Sources

[1][Official]『カーセンサーnet』、『C-MATCH』への不正アクセスに伴う個人情報漏えいに関するお詫びとお知らせRecruit · 2026-10-21
[2][News]「カーセンサー」などに不正アクセス、最大371万件の個人情報漏えいかITmedia NEWS · 2026-10-21 12:41