Baitoru breach: overseas access exposes up to 3.88 million member emails at dip's Japanese job site

Introduction

On October 9, 2026, dip Corporation (ディップ株式会社), the company behind the Japanese job sites Baitoru (バイトル) and Baitoru NEXT (バイトルNEXT), published a notice confirming that unauthorized access from overseas exposed up to 3,885,771 email addresses of registered members. NHK and TBS reported the incident the same night.

The good news is that, according to the company, only email addresses leaked: names, phone numbers, passwords and card details are not included. The bad news is that a list of almost 3.9 million email addresses belonging to job seekers is exactly the kind of material scammers love to use.

In this article we summarize what dip has confirmed, the real risk for people with an account, and what small and medium-sized businesses in Japan can learn from the case, whether they hire through Baitoru or run their own website with a member area. All information comes from the sources listed at the end.

What dip has confirmed

According to the company's official notice:

• October 6, 2026: dip detected unauthorized access by a third party to part of the website's functions.
• Right after that, the company blocked all access from overseas and fixed the affected program, saying it has completed its technical defensive measures.
• On the same day, affected members were notified inside Baitoru and Baitoru NEXT, and the company began sending individual notices by email in stages.
• October 9: the official notice was published with the maximum number of affected records.

As for the cause, dip only says it was access from overseas that exploited a specification flaw (仕様の不備) in one of the system's functions. The company did not say which function or how the flaw worked, which is normal while the investigation continues.

dip also said it has reported the incident to the Personal Information Protection Commission (PPC) and to the Kanto Bureau of Telecommunications of the Ministry of Internal Affairs and Communications (MIC), and that it is consulting the police. Its services, including Baitoru and Baitoru NEXT, remain available as usual.

What data leaked

According to the official notice:

• Up to 3,885,771 records of Baitoru and Baitoru NEXT members may be affected. This is the maximum figure, not necessarily the number of distinct people.
• Only the email address leaked.
• Not included: name, phone number, password and credit card details.
• As of the notice, the company had not confirmed any leak of other personal data, publication of the addresses online, or misuse.

The real risk: job-themed phishing

An email address on its own looks harmless, but context matters. Whoever holds this list knows that every address belongs to someone who uses a site for part-time and temporary jobs. That makes it easier to write fake messages that look legitimate, for example:

• a "Baitoru notice" asking you to verify your account or "reset your password" through a fake link;
• a job offer that is too good to be true, asking for personal data, ID documents or an upfront payment;
• "interview" invitations that lead to sites that steal logins or install apps.

These scenarios are our own risk analysis, not facts reported by dip. The company does give the same warning, though: it asks users to watch out for spam and impersonation emails, recommends not opening unknown links or attachments, and states that it never asks for passwords or card details by email.

What to do if you have a Baitoru account

1. Be suspicious of any email or SMS "from Baitoru" asking for your login, password, card or a payment. Always go in by typing the site address or using the official app, never through the link in the message.
2. Change your password if you use the same (or a similar) password on other services. dip says passwords did not leak, but password reuse is always a risk.
3. Turn on two-factor authentication for your main email account.
4. Be careful with jobs that ask for money or documents at the first contact. Legitimate employers do not charge you to hire you.
5. If in doubt, use the official contact form listed in dip's notice.

What your business can learn from this

Even without the technical details, the case offers practical lessons for any SMB with a website, a form or a member area.

If you hire through Baitoru or other job sites:

• Tell applicants that your company never asks for passwords, bank details or payments by email. One sentence in the job ad or in your auto-reply already helps.
• Standardize contact: always use the same channel (the job site's system or your own email domain), so applicants can recognize fake messages.

If you run a website with customer or member accounts:

1. Review the functions that return user data. Search, registration checks, "forgot password" and internal APIs should not show more than necessary, nor confirm whether an email address exists.
2. Rate-limit requests. An abnormal volume of lookups from a few addresses is a classic sign of automated scraping. Rate limits and alerts help you notice early.
3. Monitor your logs and have someone responsible for watching alerts outside business hours.
4. Have a containment plan. dip blocked all overseas access as an immediate measure. For many SMBs that only serve Japan, keeping that block ready (for example in your WAF or CDN) can buy precious hours during an incident.
5. Collect only what you need and delete data from inactive accounts. What you don't store can't leak.
6. Know the notification rules. Under Japan's personal data law (APPI), reporting to the PPC is mandatory for leaks involving more than 1,000 people or when bad faith is suspected, such as unauthorized access. There is a preliminary report "without delay" and a final report within 30 days (60 days in bad-faith cases).
7. Keep a notice template ready: what happened, which data, what customers should do, and a contact channel. dip's notice follows this structure and is a useful reference.

This is also one more case in a recent run of incidents in Japan, such as the BOOKOFF breach, the Lawson ID breach and the Commune platform breach. In all of them, the scam that follows is usually phishing.

Conclusion

The Baitoru leak affected "only" email addresses, but at scale: up to 3.9 million records. dip reacted quickly, blocked access, fixed the flaw and notified users, but the list is already in third-party hands. That is why, over the coming weeks, the main defense is to be suspicious of job-themed messages.

The investigation is ongoing and the numbers may change. We will update this article if dip releases new facts.

Sources

• ディップ株式会社: 「バイトル」「バイトルNEXT」不正アクセスによる一部メールアドレス漏えいに関するお知らせとお詫び (2026-10-09)
• NHKニュース: 「バイトル」会員メールアドレス 388万件余漏えいのおそれ
• TBS NEWS DIG: 「バイトル」など運営の「ディップ」 最大388万件あまりの会員メールアドレス流出のおそれ
• 個人情報保護委員会 (PPC): 漏えい等の対応とお役立ち資料

---

Want this for your business?

KGA IT helps small and medium-sized businesses set up AI assistants, automation and websites. The consultation is free and we reply within 24 hours. Plans start at ¥5,000/month.

• Phone: 080-9732-1062
• Email: kga-it@outlook.com
• Contact page: kga-it.com/en/contact