CARS24 alleges customer data theft in dealer leak

Used-car marketplace CARS24 has complained to cybercrime police that confidential information linked to about 3,100 customers was unlawfully taken and passed to a competing business and outside vehicle dealers, with individual sales leads allegedly offered for roughly ₹1,000 each.

The company has estimated the resulting commercial loss at about ₹5.70 crore, according to details of the complaint. The figure is CARS24’s assessment of business damage and should not be read as a police finding or a confirmed valuation of the information allegedly taken.

The complaint describes the material as customer leads generated through CARS24’s operations. Such leads can contain information supplied by people seeking to sell or buy vehicles and may have significant commercial value because dealers can use them to contact prospective customers before a transaction is completed.

CARS24 alleges that the data was diverted without authorisation and supplied beyond its approved business channels. The complaint seeks a cybercrime investigation into how the records were accessed, who transferred them, who received them and whether money changed hands for the information.

The allegation centres on the misuse of customer information rather than a publicly established intrusion into CARS24’s technology systems. Available details do not establish that hackers breached the company’s servers, and the description of the case does not by itself show that all affected records contained the same categories of personal information.

That distinction is significant because a conventional external cyberattack, an insider theft and unauthorised sharing by a contractor can involve different evidence, responsibilities and legal questions. Investigators would typically seek access logs, internal communications, device records, account permissions and payment trails to determine whether data was copied or exported and by whom.

No police conclusion establishing criminal liability has been made public in the information available about the complaint. The identities and roles of all people or businesses accused in the filing have also not been independently confirmed, and allegations in a complaint remain subject to investigation.

CARS24 operates a technology-led marketplace for pre-owned vehicles and says its selling model connects vehicles with a verified dealer network nationwide. Its own website states that dealers bid for cars through a nationwide auction model, making prospective seller information commercially important within the platform’s transaction pipeline.

The company’s terms and services also show that its business processes involve vehicle and customer data, including information used for inspections, ownership documentation, transactions and vehicle-history products. That makes access controls and limits on secondary use of customer information a data-governance issue for platforms operating at scale.

India’s cybercrime framework leaves investigation and prosecution with state and Union Territory law-enforcement agencies. The Ministry of Home Affairs says cybercrime complaints can also be submitted through the National Cyber Crime Reporting Portal, while police agencies handle investigation, registration of cases and subsequent action according to jurisdiction and applicable law.

The broader legal environment for companies handling digital information is also tightening as India’s personal-data protection regime develops. Organisations collecting customer information are expected to apply safeguards against unauthorised processing or disclosure and to maintain controls appropriate to the nature and volume of data they hold.

For investigators, the claimed ₹1,000 price per lead may be relevant if digital payment records, dealer communications or transaction histories support the allegation. The larger ₹5.70-crore loss figure, however, appears to represent CARS24’s claimed commercial impact rather than a simple multiplication of 3,100 records by the alleged lead price.

At ₹1,000 for each of 3,100 leads, the direct notional sale value would be about ₹31 lakh. The gap between that amount and the claimed ₹5.70-crore loss indicates that the company’s calculation may include lost business, foregone transactions or other commercial effects, although the methodology has not been publicly detailed.

The investigation will therefore need to distinguish between the number of customer records allegedly exposed, the amount obtained from any sale of those records and the wider business loss asserted by CARS24.