Thousands of CARS24 records exposed as customer leads allegedly go for just $11
Exposed records include customer names, mobile numbers, and vehicle details.
Image via Shuttertock
- CARS24 says about 3,100 customer records were stolen and supplied to Punjab-based Direct-Cars.
- The complaint says exposed data included names, phone numbers, vehicle details, appointments, pricing, and sales leads.
- Police are investigating who accessed the data and whether more car dealers received it.
- CARS24 estimates about $600,000 in lost business, but the figure remains unverified.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Customer data from CARS24, a large Indian platform for buying and selling used cars, was allegedly stolen and sold to a rival business and car dealers, with customer leads reportedly offered for around ₹1,000 ($11) each.
The420 reported that CARS24 filed a complaint at a Cyber Crime Police Station and named five people in the FIR, alleging that details of about 3,100 customers had been stolen.
According to the complaint, the data included customer names, mobile numbers, vehicle details, appointments, inspection reports, pricing information, sales leads, and other internal business records.
Such data could be used for targeted scams or phishing using customer vehicle or appointment information, or for unsolicited advertising by a dealer eager to offer a more attractive price.
The company said it became aware of the situation when CARS24 customers started receiving calls from people associated with another business. WhatsApp messages later uncovered during CARS24's internal investigation suggested that customer leads were sold for around ₹1,000 ($11) each.
The information was obtained between March and August and passed to Punjab-based Direct-cars, although the report didn't provide further details about the business.
The420 said the police are currently trying to determine the source of the leak, as well as whether the data was sold to additional dealers.
The alleged diversion resulted in an estimated ₹5.70 crore (roughly $600,000) in lost business, although the exact amount had not been independently established. CARS24 reported ₹5,092 crore ($539 million) in operating revenue in FY26, down 18.3% year-on-year.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
This is not the first large-scale breach for the automotive sector. In 2025, 700Credit, a consumer financing services company used by over 20,000 auto, motorcycle, RV, and marine dealerships across the US, suffered a breach exposing the sensitive data of more than 5.8 million Americans, including Social Security numbers.
