Data leak
CarGurus ShinyHunters Data Breach - 12.4M Accounts
Primary Source ↗Incident Details
In February 2026, ShinyHunters breached CarGurus (a major US online automotive marketplace) via social engineering. After CarGurus declined to pay ransom, the data was published publicly. The breach exposed records for approximately 12.4 million accounts. Exposed data included email addresses, names, phone numbers, physical and IP addresses, user account IDs, finance pre-qualification application data, and dealer account and subscription information. Dealer data feeds and core platform functionality were not impacted. Have I Been Pwned indexed 12.5 million affected email addresses.
Technical Details
- Initial Attack Vector
- ShinyHunters used social engineering (pretexting/vishing — impersonating employees calling the help desk for password resets) to gain unauthorized access to CarGurus systems
Timeline
- 2026-02-01 Breach occurred
- 2026-02-24 Publicly disclosed
- 2026-02-24 Customers notified