CarGurus
Disclosed Feb 22, 20267 months ago12,461,887 accountsUnverified
ShinyHunters leaks 12.4 million CarGurus account records
ShinyHunters published a 6.1 GB archive it said came from CarGurus, and Have I Been Pwned loaded 12.4 million records including contact details and finance pre-qualification data. CarGurus did not publish a statement.
What is known
| People affected | 12,461,887 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | Feb 22, 2026 |
| Happened | Feb 14, 2026 |
| Attack | Extortion |
| Data exposed | Emails, IP addresses, Names, Phone numbers, Addresses, Financial |
| Sector | Tech · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Have I Been Pwned: CarGurushaveibeenpwned.com · Aggregator | Aggregator |
| CarGurus data breach affects 12.5 million accountstechcrunch.com · News | News |
| CarGurus data breach exposes information of 12.4 million accountsbleepingcomputer.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Have I Been Pwnedaccounts in the data | Feb 22 | 12,461,887 |
| Researchtotal | Feb 22 |
History of this record
- 2026-09-25 · source_type: aggregator to press · seed source
- 2026-09-25 · source_url: https://haveibeenpwned.com/Breach/CarGurus to https://www.bleepingcomputer.com/news/security/cargurus-data-breach-exposes-information-of-124-million-accounts/ · seed source
- 2026-09-25 · country: empty to US · seed source
- 2026-09-25 · data_types: ["emails","ip-addresses","names","phone","addresses"] to ["emails","ip-addresses","names","phone","addresses","financial"] · seed source
- 2026-09-25 · summary: In February 2026, the automotive marketplace CarGurus was the target of a data breach attributed to the threat actor ShinyHunters . Following an attempted extortion, the data was published publicly and contained more than 12M email addresse to ShinyHunters published a 6.1 GB archive it said came from CarGurus, and Have I Been Pwned loaded 12.4 million records including contact details and finance pre-qualification data. CarGurus did not publish a statement. · seed source
- 2026-09-25 · title: empty to ShinyHunters leaks 12.4 million CarGurus account records · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.