CarMax

Disclosed Feb 20, 2026431,371 accountsUnverified

In January 2026, data allegedly sourced from US automotive retailer CarMax was published online following a failed extortion attempt . The data included 431k unique email addresses along with names, phone numbers and physical addresses.

What is known

People affected	431,371 (accounts in the leaked data, per Have I Been Pwned)
Disclosed	Feb 20, 2026
Happened	Jan 24, 2026
Attack	Extortion
Data exposed	EmailsNamesPhone numbersAddresses
Sector	Tech
Status	Unverified: not yet confirmed by an official notice, a filing or the organization
Check your email	Have I Been Pwned

Sources

Aggregatorhaveibeenpwned.com

Have I Been Pwned: CarMax

Notices filed

Accounts in the dataFeb 20

Have I Been Pwned431,371 people

History of this record

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.

Everything about CarMax