- The Mess: CARS24 says data linked to around 3,100 customers was allegedly stolen from its systems and sold to a rival dealer for roughly ₹1,000 ($11) per lead.
The complaint says the information was taken between March and August and supplied to Punjab-based Direct-Cars. Police have registered a case and are investigating how the data left CARS24 systems.
- The Damage: The exposed records allegedly included names, phone numbers, vehicle details, appointments, inspection reports, pricing information and sales leads — enough information to target customers with highly convincing scams or competing sales offers.
CARS24 estimates the alleged data diversion caused around ₹5.70 crore ($600,000) in lost business, although that figure has not been independently verified.
The company also claims its internal investigation found WhatsApp conversations discussing the customer leads. Five people have been named in the police complaint. Their involvement remains an allegation while the investigation continues.
- The Fix: CARS24 customers should be suspicious of unexpected calls or messages containing specific vehicle, appointment or pricing information, while companies should tightly control access to customer-lead databases and audit who exports them.
This incident is a reminder that attackers don’t always need millions of records.
A few thousand highly detailed customer profiles can be more valuable than a huge database full of useless fields.
Bugstoday’s Opinion
This is what makes the story interesting.
The alleged attackers didn’t need to dump an entire customer database and disappear into the dark web. The data allegedly became a sales product — one customer lead at a time.
₹1,000 for a person who is actively looking to sell or buy a car is a very different commodity from a random email database.
And if the allegations are confirmed, the security failure wasn’t just about privacy.
It became a business channel for someone else.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- CARS24 complaint / Cyber Crime Police investigation
- Cybernews
- GBHackers
- The420
