Thousands of CARS24 Customer Records Allegedly Sold for $11 Each

CARS24 says customer information from around 3,100 people was allegedly stolen and sold to rival businesses and car dealers in India.

The CARS24 customer data reportedly included names, mobile numbers, vehicle details, appointments, inspection reports, pricing information and sales leads. According to the complaint, individual customer leads were offered for about ₹1,000, or roughly $11.

Police are investigating how the information was accessed and whether the data reached more dealers.

CARS24 files complaint over alleged data theft

CARS24, a major Indian platform for buying and selling used vehicles, filed a complaint with a Cyber Crime Police Station. The company named five people in the FIR.

Reports say the company began investigating after customers received unsolicited calls from people connected to another business. CARS24 later found WhatsApp messages that allegedly showed customer leads being sold.

The complaint alleges that the records were collected between March and August. The data was then reportedly passed to Punjab-based Direct-Cars, although further details about the business were not disclosed.

Exposed records could support targeted scams

The alleged exposure includes enough personal and transaction data to support convincing scams.

Criminals or aggressive competitors could use vehicle details, inspections, appointments and price information to contact customers with personalised offers. They could also impersonate CARS24 staff or claim to have information about a customer’s vehicle sale.

This type of information can make phishing messages and phone scams more credible. It may also lead to unwanted marketing calls from rival dealerships.

Police investigate the source of the leak

Authorities are now trying to establish how the CARS24 customer data was obtained. Investigators are also looking into whether the information was sold to other dealerships.

CARS24 estimates that the alleged diversion caused around ₹5.70 crore, or approximately $600,000, in lost business. That figure has not been independently verified.

The company reported operating revenue of ₹5,092 crore, or around $539 million, for FY26. That represented an 18.3% year-on-year decline.

Automotive data remains a valuable target

The case highlights the data risks facing automotive businesses. Dealerships and car platforms hold valuable customer records that often combine identity details, contact information, vehicle data and financial information.

In 2025, consumer financing company 700Credit suffered a breach that exposed sensitive data belonging to more than 5.8 million people in the US.

CARS24 customers should remain cautious about unexpected calls or messages related to vehicle sales, inspections or financing. They should independently verify any request before sharing personal or financial information.