Baitoru hack may have leaked 3.88M member emails

Up to 3.88M Baitoru member email addresses may have leaked

An outside party got into some functions of the Baitoru and Baitoru NEXT websites, and some member email addresses leaked. dip, which runs both job sites, confirmed the unauthorized access on Oct 6 and published a notice on its own news page on Oct 9. The notice puts the number of addresses that may have leaked at up to 3,885,771.

Here are the main points of the notice. Both sites are job boards that dip runs.

The Baitoru leak at a glance (from dip's notice)

Item	Detail
Unauthorized access confirmed	Oct 6, 2026
Notice published	Oct 9, 2026
Sites affected	Baitoru and Baitoru NEXT
Addresses that may have leaked	Up to 3,885,771
Data involved	Email addresses only

Bookoff Group Holdings disclosed a member data leak on the same day. That case is covered in Bookoff hack may have leaked 6.43M member records.

Some addresses leaked, and 3.88M is the upper limit

dip says it has confirmed that "some" member email addresses leaked, and 3,885,771 is the most that may be involved. The notice does not say how many addresses actually left its systems.

In other words, dip has not said that all 3,885,771 addresses leaked. If you have a Baitoru or Baitoru NEXT account, you cannot yet tell from the notice whether your address is one of them.

Only email addresses leaked, not passwords or card data

The leaked data is email addresses only. The notice lists four kinds of data that were not involved:

• Names
• Phone numbers
• Passwords
• Credit card data

dip has not asked members to change their passwords. It also says it has not found any other personal data leaving its systems, and that as of the notice there was no sign of the addresses being posted online or misused.

A site vulnerability let overseas attackers in

dip says the attackers came from overseas and exploited a vulnerability in some system functions. A vulnerability is a weakness in a system that attackers can use to get in. The notice does not say which feature was affected or what the vulnerability was.

Right after confirming the access, dip blocked all access from overseas. It also fixed the affected code so the same method no longer works, and it says it has further strengthened its security measures and monitoring.

dip notified affected members on the Baitoru and Baitoru NEXT sites on Oct 6 and is emailing each of them individually. It is reporting the case to the Personal Information Protection Commission and the Kanto Bureau of Telecommunications, and it is consulting the police. Both sites are still running as usual.

Watch for spam and spoofed emails after the leak

If the leaked addresses are misused, members may receive spam or spoofed emails. A spoofed email is one made to look as if it came from a real company or person. dip asks members to be careful with suspicious mail and not to open links or attachments they do not recognize.

dip says it never asks for passwords or credit card data by email or any other channel. So an email that claims to be from dip and asks for either one is fake.

dip takes questions through a dedicated web form

Users can send questions about the leak through dip's inquiry form. The form is in Japanese. Press inquiries go to dip's PR department instead.

How companies and staff can guard against spoofed email

A leaked address list makes phishing more likely: fake emails that pose as real companies or services. Phishing lures people to fake sites to steal login IDs and passwords. Japan's National Police Agency says these emails often use urgent wording, such as a "personal data leak" or "unauthorized access detected", to push people into logging in.

The agency also warns that the sender name and address shown in an email are easy to change, so you cannot judge an email by them alone. The measures below are split into what a company can do and what each employee can do.

Companies can adopt sender domain authentication

A company can adopt sender domain authentication, which lets mail servers tell whether an email really came from the domain it claims. The National Police Agency asks businesses to consider it to keep their own domains from being abused. The main methods are:

• SPF: checks whether the IP address of the sending server is allowed for the domain
• DKIM: checks the digital signature attached to the email
• DMARC: combines SPF and DKIM

With DMARC, the sender decides what happens to email that fails these checks. A sender can set a policy such as "do not accept spoofed email", and receiving servers then apply it.

Staff should open sites from bookmarks, not email links

Each employee can skip links in emails and open services from a bookmark or the official app instead. The National Police Agency recommends bookmarking official sites in advance or using official apps to reach the right site. It also recommends these steps:

• Use a different login ID and password for each site, and do not reuse them
• Keep the OS and apps updated so PCs and smartphones stay safe
• If you entered a login ID or password on a fake site, change that password right away on every service that uses it