dip disclosed on Friday that up to 3.88 million Baitoru member email addresses may have leaked. No names, no passwords, no phone numbers. Just emails. That is all a phisher needs, and dip knows it: the company warned its own users to watch for suspicious mail. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. A clean list of 3.88 million verified addresses, every one of them a job seeker, is not a minor breach. It is a complete phishing kit.
What dip confirmed
The disclosure came on 9 October, reported by Asahi Shimbun, NHK and TBS NEWS DIG. Here is what the disclosure confirms, and what it does not:
| Confirmed | Still unconfirmed |
|---|---|
| The disclosure: dip announced the incident itself on 9 October | Whether any data actually left dip's systems; the company says "may have leaked" |
| The vector: unauthorised overseas access detected on 6 October, exploiting a flaw in the specification of one of the sites' functions | What the specification flaw was; dip has not described the affected function |
| Up to 3,885,771 member email addresses at risk, across Baitoru and Baitoru NEXT | How many of those addresses, if any, were actually accessed |
| The data: email addresses only; per the company, no names, phone numbers, passwords or credit card data | Whether the dataset has surfaced anywhere or been traded |
| No confirmed external outflow or misuse as of the disclosure | Whether the attacker retains a way to use the access |
| Reported to the Personal Information Protection Commission; police consulted | What the investigation will find |
| dip blocked overseas access to the function, fixed the software, and strengthened monitoring; the sites stay online | How long the flaw was exploitable before the 6 October detection |
| Members were notified on the sites on 6 October; individual email notices are going out in sequence | The exact timeline of the individual notifications |
The figure 3,885,771 comes from Niconico News' report of dip's announcement, which also carried the response details. Every outlet frames this as a risk, not a confirmed exfiltration. Keep that distinction.
Why "just emails" is the whole attack
Start with dip's own warning, because it settles the argument. The company told users, in its own notice, that:
dip's member notice warns that suspicious emails may arrive, and asks users not to open unknown links or attachments, as reported by TBS NEWS DIG.
A warning like that only makes sense if an email-only list is dangerous. dip will not say it that way, but the warning says it anyway.
dip is now notifying affected members individually by email. The attacker can send the same notification. Same wording, quoted word for word, and a lookalike page behind the link. Both emails will land side by side in the same inbox, and their content will be identical. There is no way to tell them apart by reading them. The only test left is the channel.
The recipients are job seekers, and that is the detail that turns this list from a nuisance into a weapon. A person waiting to hear from employers opens mail that says "a company viewed your profile" or "a new offer matches your registration". It is not curiosity that does it; it is hope. A generic stolen address list has no such property. A file of 3.88 million people actively looking for work does.
Then there is the unglamorous part that decides whether a phishing operation works: deliverability. Most stolen email lists are rotten with dead accounts. Every address in this one belonged to a registered member of a working service. For the attacker, this file arrives pre-validated. Live addresses, known to belong to real people, already sorted by context.
Credential stuffing is the move that needs no passwords at all. The file contains none, but the attacker does not need dip's. They pair the confirmed addresses with passwords from every other breach on record and run the combinations. Anyone who reused a password anywhere else is exposed through a file that contains no password. That is the quiet trick of the "emails only" framing: the file does not have to hold the secret to open the account.
This is the third email-heavy breach of the same disclosure wave. The same week brought Bookoff's disclosure and the JR East group breach via IDC Frontier, where the ekineko and Viewcard portions were also mostly email addresses. The pattern of the season is lists of live addresses, not full identity records. The defence is the same for all of them.
dip is sending real individual notifications by email. Forged copies of that notification will arrive beside them, quoting the real text and linking to a fake page. Any message about this breach, real or fake, should not be clicked. Open Baitoru's own site directly, typed by you into the browser.
The one field you could have made expendable
You cannot change your name or your phone number. But the email address you registered on Baitoru was a choice, and it is the one field in this file you could have made expendable.
The mechanism is a dedicated email alias for the Baitoru signup, forwarding to your real inbox. Every message that arrives on that alias is either from Baitoru or from the attacker, and there is no third option. A fake "job offer" or a forged breach notification landing on an address that only Baitoru ever had has identified itself. Kill the alias and the channel dies while your real inbox stays clean. That is the leak-tracing mechanism pointed at exactly this attack: the alias tells you which company the message escaped from. The set-up guide takes about two minutes.
Job sites are the inbox nobody thinks to protect. You register once, wait for employer contact, and forget the account exists. A registration list of 3.88 million job seekers sitting behind one specification flaw is not the surprise here. The surprise would be learning from it the first time.
What Baitoru members should do now
That address has been yours for years, and it is an unpleasant feeling to find it sitting in someone else's file. Here is the practical side:
- Expect phishing that knows you use Baitoru. Fake job offers, fake employer screening messages, and forged dip notifications are the likeliest abuse. Any message that "confirms" you by referencing Baitoru is proving it has the file, not that it is legitimate.
- Do not click links in any email about this breach, including the real notification. Open Baitoru's own site directly. A habit that works against the forgeries must work against the genuine ones.
- Do not reuse your Baitoru password anywhere else. Passwords were not in the data, but credential stuffing pairs your leaked address with passwords from other breaches. If it matches another site's password, change it there now.
- Check Have I Been Pwned once the incident is listed, and see if your email was leaked for the full checking routine.
- Walk the breach-response order of operations: it is written for exactly this situation.
Where this goes from here
Three things to watch. First, whether dip upgrades "may have leaked" to confirmed exfiltration, and whether it names a real number taken. Second, whether the dataset surfaces on any forum or marketplace, which would turn a contained incident into a circulating one. Third, the technical detail dip has not given: which function had the specification flaw, and how long it was exploitable before 6 October. That answer decides whether this was a one-day grab or a longer window. The investigation continues. The phishing wave does not need to wait for it.
Top comments (0)