I would tell him straight up, specifying that you don't know if that is his car but if it were then people might get access to his personal info.

If you tell him you didn't check out the website, I see no reason for him to disbelieve you and/or be angry. Not being tech savvy, he may, instead, be grateful to learn how easily his personal info might be accessed.