Browse
Log in / Register
Share
Japan's major second-hand retail platforms are offline heading into the week. Carsensor, 2nd Street and Geo all suspended their websites over the weekend after unauthorized access, and Recruit Holdings — the operator of Carsensor — says it cannot yet rule out a leak of customer data. As of Feb. 16, 2025, services remain suspended while investigations continue.
Carsensor, one of Japan's largest used-car marketplaces, went dark at about 5 p.m. Japan time. Recruit Holdings, the media and HR conglomerate that operates the platform, said it detected unauthorized access and suspended the service to protect users. Recruit is still checking whether personal data was exposed. It also said it has no estimate yet for when the site will be restored.
The timing is awkward for the company. Carsensor is not a niche service; it is a core channel for used-car dealers across Japan, with hundreds of thousands of vehicles listed at any given time. Every hour of downtime means lost connections between buyers and sellers.
The same day, 2nd Street, which runs a nationwide chain of stores buying and selling used clothing, furniture and household goods, reported unauthorized access to its own systems. Geo, a retailer of video games, smartphones and entertainment software, did the same. Both companies shut down their e-commerce sites and mobile apps as a precaution. Neither has given a restoration date.
The weekend incidents are part of a pattern that has been building for weeks.
Last week, a Japanese restaurant chain said it had suffered a leak of a large volume of personal data, including information about customers that could be used for phishing or fraud. A software production company also reported a major data leak. Both companies were still quantifying the damage late last week.
Even public services have been hit. Unauthorized access forced the suspension of administrative email alert systems that are used to send disaster information to residents. For Japan, where earthquakes, typhoons and other natural disasters are a constant concern, those alerts are not optional infrastructure. The disruption has raised questions about the security of other government-run communication systems.
The impact has extended to Japan's cloud sector. IDC Frontier, a subsidiary of SoftBank Corp., reported a cyberattack earlier this month. While the attack affected its own cloud service, the damage rippled outward: even clients who had not been directly attacked found that they could no longer back up their data.
On Sunday, IDC Frontier announced that those clients could resume backup operations, after the company said it had confirmed the safety of its systems. The recovery is good news, but the incident highlights a structural vulnerability. When a cloud operator is breached, the failure can amplify across an entire ecosystem of dependent businesses.
Security researchers in Japan have been warning about this kind of supply-chain risk for years. A single compromised vendor can serve as a gateway to dozens or hundreds of other organizations. The IDC Frontier case is a relatively mild example: services were disrupted, but there is no public evidence that backup data itself was accessed.
For international observers, the attacks are a reminder that Japan's cybersecurity posture has not kept pace with its rapid digitization. The country has experienced several high-profile incidents in recent years. In 2022, Toyota had to stop production lines after a supplier was hit by a cyberattack. In 2024, publishing group KADOKAWA was paralyzed by a ransomware attack that knocked its Niconico video service offline for months.
What is different in the current wave is the lack of a single headline target. Instead, attackers appear to be probing multiple mid-sized companies and platforms at once, striking where defenses are weakest. That approach matches the tactics seen in several recent ransomware campaigns, in which threat actors prioritize volume over visibility.
The pattern also echoes recent attacks in the United States and Europe, where cybercriminals have targeted retail and technology platforms specifically for customer data. In that sense, the Japanese incidents are part of a global trend rather than a local anomaly. But Japan's heavy reliance on aging IT systems in some sectors has given attackers a relatively easier entry point, analysts say.
The economic stakes are high. Japan's used goods market is a significant and growing sector, boosted by environmental awareness and tight household budgets. Platforms such as Carsensor and 2nd Street are central to that market's efficiency, providing trust mechanisms, payment processing and logistics connections that individual sellers and small shops cannot replicate.
Recruit, 2nd Street and Geo have not confirmed that customer data was taken, but the possibility alone justifies caution. Anyone who has used these services should monitor email and bank statements for unusual activity. It is also a reasonable moment to change passwords, especially if the same password was used on other sites. Enabling two-factor authentication is one of the most effective steps a user can take, and it costs nothing.
Users should also be alert to scams that often follow data breaches. Fraudsters routinely send phishing emails posing as the affected company, offering "compensation" or asking recipients to "verify" their accounts. Legitimate companies do not ask for passwords by email.
Recruit has promised to notify users if the investigation confirms that personal data was accessed.
Regulators, meanwhile, are likely to watch the handling of these incidents closely. Japan's data protection rules require companies to report breaches and notify affected individuals, and the recent run of incidents is putting those requirements under the spotlight.
At this point, none of the affected companies has announced a timetable for returning online. Recruit said it is prioritizing the security investigation over a quick fix. That is a sensible position, but the longer the outage lasts, the more it will test the patience of users and business partners.
In the broader context, these incidents should push Japanese companies to take a harder look at their security basics: patching systems, segmenting networks and reviewing access controls. Many of the breaches reported in recent weeks are believed to have started with relatively simple vulnerabilities, according to security engineers familiar with the cases.
The Japanese government has not yet issued a formal statement on the weekend's incidents. Its cybersecurity strategy, revised in recent years, calls for businesses to treat cyber risks as a management issue rather than a matter for IT departments alone. Whether that message is sinking in remains to be seen.
The weekend's unauthorized access events are not the largest Japan has seen, but they are among the most consequential for everyday consumers. When the sites that people use to buy a car or a phone are knocked offline by a hacker, the abstract threat of cybercrime suddenly becomes very real.
