CarMax
Disclosed Feb 20, 20267 months ago431,371 accountsUnverified
In January 2026, data allegedly sourced from US automotive retailer CarMax was published online following a failed extortion attempt . The data included 431k unique email addresses along with names, phone numbers and physical addresses.
What is known
| People affected | 431,371 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | Feb 20, 2026 |
| Happened | Jan 24, 2026 |
| Attack | Extortion |
| Data exposed | Emails, Names, Phone numbers, Addresses |
| Sector | Tech |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Have I Been Pwned: CarMaxhaveibeenpwned.com · Aggregator | Aggregator |
Notices filed
| Where | Filed | People |
|---|---|---|
| Have I Been Pwnedaccounts in the data | Feb 20 | 431,371 |
History of this record
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.