Used-car platform CARS24 has alleged that confidential records linked to around 3,100 customers were unlawfully extracted and sold to a competing business and external vehicle dealers for approximately ₹1,000 per lead.
The company estimates that the alleged data diversion caused commercial losses of about ₹5.70 crore. However, the loss estimate and allegations have not been independently established by police or a court.
A case has been registered at the Cyber Crime Police Station following a complaint filed by CARS24 legal head Shyamal Anand. The FIR names five individuals: Preeti, Pallavi, Kalpana, Sahil Rana and Mohit.
CARS24 Alleges 3,100 Customer Records Stolen
According to the420, the information was allegedly taken between March and August and supplied to Punjab-based Direct-Cars. The alleged compromise reportedly involved more than customer contact numbers.
CARS24 claims the records included customer names, mobile numbers, vehicle details, appointment information, inspection reports, pricing data, sales leads, and other internal business information.
Such data can be particularly valuable in the used-car market because it identifies people who are actively considering selling a vehicle.
A dealer with access to the information could contact a potential seller directly, bypassing advertising costs, lead-generation campaigns, and the standard vehicle acquisition process.
CARS24 reportedly became aware of the alleged leak after individuals associated with another business contacted its customers.
During an internal inquiry, the company allegedly found WhatsApp conversations indicating that customer leads were being offered for about ₹1,000 each.
The company has alleged that the information was used to divert potential vehicle sellers and buyers away from its platform. Police are now investigating whether the records were sold to other dealers or individuals beyond the business identified in the complaint.
The case underscores that a data breach does not necessarily require an external hacker to exploit a technical vulnerability or bypass a firewall.
An insider, employee, contractor, or other authorized user can create a breach by copying, exporting, sharing, or selling customer data without permission.
Investigators will need to establish the original access point for the alleged data extraction. This may involve analyzing account login histories, database access records, bulk download activity, endpoint telemetry, email logs, removable device activity, and cloud storage transfers.
Forensic investigators may also examine whether the data was exported through a legitimate account, accessed using stolen credentials or transferred through messaging applications.
At this stage, authorities have not publicly disclosed the technical method allegedly used to obtain the 3,100 customer records. The allegations come as India continues to strengthen its personal data protection regime under the Digital Personal Data Protection Act.
Organizations handling personal information are expected to implement reasonable security safeguards, while penalties for certain failures may reach ₹250 crore under the law’s provisions and phased implementation framework.
For affected consumers, the immediate concern is targeted outreach. A caller who already knows a customer’s name, vehicle model, expected price, or inspection details may appear credible and could attempt to obtain additional information.
Customers should avoid sharing OTPs, identity documents, banking details, or payment information with unsolicited callers, even if the caller appears to know details about a vehicle listing. They should also ask how their information was obtained and report suspicious contact to the original platform.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
