CARS24 Says Data Breach Compromised Over 3,000 Customer Leads, Allegedly Sold for About ₹1,000 Each

India's online used‑car marketplace CARS24 announced that personal details of roughly 3,100 customers were accessed without authorization and subsequently passed on to a competing firm and external dealers. The company estimates that the stolen leads were offered at a price of around ₹1,000 per record, suggesting a modest but tangible commercial loss.

According to CARS24, the breach involved contact information and vehicle‑interest data that sellers typically provide when listing a car on the platform. While the exact method of intrusion has not been disclosed, the firm says the information was extracted and shared with third parties who could use it to approach potential buyers directly.

The incident arrives amid a wave of data‑security concerns in India’s burgeoning digital economy, where regulators are tightening oversight under the Personal Data Protection Bill and the Information Technology Act. Industry observers note that the used‑car sector relies heavily on lead generation, making customer data a valuable commodity for rivals seeking to undercut competitors.

CARS24’s statement emphasized that no financial transaction data or payment credentials were involved, limiting the breach to contact and preference details. Nonetheless, the company warned that affected individuals could receive unsolicited calls or messages from dealers seeking to convert the leaked leads into sales.

Consumer‑rights groups have called for a thorough investigation, urging the authorities to assess whether the breach constitutes a violation of data‑protection norms. They also stress the need for clearer guidelines on how companies must secure lead information, which is often less protected than payment data.

In response, CARS24 said it is cooperating with law‑enforcement agencies and has engaged a cybersecurity firm to conduct a forensic review. The firm also announced plans to reinforce its data‑handling protocols and to notify affected customers directly. The episode highlights the growing challenge of safeguarding personal data in a market where digital platforms are increasingly the primary conduit for buying and selling used vehicles.