CarGurus: a data breach
In February 2026, the automotive marketplace CarGurus was the target of a data breach attributed to the threat actor ShinyHunters . Following an attempted extortion, the data was published publicly and contained more than 12M email addresses across multiple files including user account ID mappings, finance pre-qualification application data and dealer account and subscription information. Impacted data also included names, phone numbers, physical and IP addresses, and auto finance application outcomes.
The record
- Organisation
- CarGurus →
- Identity
- CarGurusidentified by its domain in a verified breach record
- Records affected
- 12,461,887 records
- Data exposed
- Email addresses, IP addresses, Names, Phone numbers, Physical addresses
- Sector
- Not recorded
- Occurred
- 2026-02-14
- Disclosed
- 2026-02-22
- First recorded here
- 2026-09-09
Fastnexa security experts
Worried the same could happen to your company?
If you are a customer or supplier of CarGurus, or work in the same industry, a Fastnexa security expert can tell you what this means for your data and test whether the same attack would work on you.
Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →
Sources (1)
One source so far.
- Have I Been Pwned ↗First reported
2026-02-22