ConfirmedData breach
CarMax: a data breach
In January 2026, data allegedly sourced from US automotive retailer CarMax was published online following a failed extortion attempt . The data included 431k unique email addresses along with names, phone numbers and physical addresses.
The record
- Organisation
- CarMax →
- Identity
- CarMaxidentified by its domain in a verified breach record
- Records affected
- 431,371 records
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses
- Sector
- Not recorded
- Occurred
- 2026-01-24
- Disclosed
- 2026-02-20
- First recorded here
- 2026-09-09
Sources (1)
One source so far.
- Have I Been Pwned ↗First reported
2026-02-20