{"id":"cargurus-contact-finance-data-breach-feb-2026","category":"breach","status":"closed","title":"CarGurus breach exposes contact and finance application data linked to 12.5 million email addresses","tldr":"Published CarGurus data includes about 12.5 million email addresses, contact details and finance application information, according to HIBP. CarGurus says the incident is contained. Treat unexpected car finance messages and payment demands cautiously.","summary":"Attackers attributed to ShinyHunters published CarGurus data after an extortion attempt in February 2026. Have I Been Pwned records approximately 12.5 million email addresses, alongside names, phone numbers, home and IP addresses, finance pre-qualification applications, application outcomes and dealer information. The initial attacker claim concerned 1.7 million corporate records; that is a different measure from HIBP's email-address count. In its 1 May update, CarGurus said an independent investigation was complete, the affected internal database had been secured and the incident was contained. Its dealer-facing statement described mainly public dealer contact information and limited sensitive data, with affected dealers contacted directly. It said dealer passwords and core systems were unaffected. That statement does not reconcile HIBP's wider findings or establish whether all affected consumers were notified. As of 3 November, the reviewed sources establish publication of the data, but no recovery or removal of it. There is no device update to install.","action":"If you used CarGurus, check your email address with Have I Been Pwned and watch for unexpected calls, texts or emails about vehicle purchases or finance. Verify requests directly with CarGurus or your lender using contact details you find independently; do not send money or share security codes in response to unsolicited messages.","product":"CarGurus automotive marketplace","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["cargurus","data-breach","extortion","shinyhunters","personal-data","finance"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Cybersecurity Incident Information","url":"https://dealers.cargurus.com/blog/cybersecurity-incident-information","by":"CarGurus","date":"2026-05-01"},{"kind":"research","title":"CarGurus Data Breach","url":"https://haveibeenpwned.com/Breach/CarGurus","by":"Have I Been Pwned","date":"2026-02-22"},{"kind":"news","title":"ShinyHunters claims it drove off with 1.7M CarGurus records","url":"https://www.theregister.com/security/2026/02/18/shinyhunters-claims-it-drove-off-with-17m-cargurus-records/4873029","by":"The Register","date":"2026-02-18"},{"kind":"news","title":"CarGurus data breach exposes information of 12.4 million accounts","url":"https://www.bleepingcomputer.com/news/security/cargurus-data-breach-exposes-information-of-124-million-accounts/","by":"BleepingComputer","date":"2026-02-24"}],"started":"2026-02-18","closed":"2026-05-01","created":"2026-11-03T20:37:54.246Z","updated":"2026-11-03T20:37:54.246Z","cve_notes":[],"timeline":[{"at":"2026-05-01","added":"2026-11-03T20:32:12.437Z","kind":"vendor-revised","text":"CarGurus said its independent investigation was complete and the internal database incident was contained. It said dealer passwords and core systems were unaffected, and dealers whose sensitive information might have been involved had been contacted directly.","url":"https://dealers.cargurus.com/blog/cybersecurity-incident-information","by":"CarGurus","patch":null},{"at":"2026-02-22","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"CarGurus says it emailed all primary dealership contacts and published a dealer-facing incident update on this date.","url":"https://dealers.cargurus.com/blog/cybersecurity-incident-information","by":"CarGurus","patch":null},{"at":"2026-02-22","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Have I Been Pwned added the breach, recording approximately 12.5 million email addresses. It identified contact details, IP addresses, finance pre-qualification applications and application outcomes among the published data.","url":"https://haveibeenpwned.com/Breach/CarGurus","by":"Have I Been Pwned","patch":null},{"at":"2026-02-21","added":"2026-11-03T20:32:12.437Z","kind":"wider-attacks","text":"According to BleepingComputer's subsequent report, ShinyHunters published a 6.1 GB archive claiming it contained 12.4 million CarGurus records.","url":"https://www.bleepingcomputer.com/news/security/cargurus-data-breach-exposes-information-of-124-million-accounts/","by":"BleepingComputer","patch":null},{"at":"2026-02-18","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"The Register reported that ShinyHunters claimed to have stolen 1.7 million CarGurus corporate records and threatened publication unless the company responded by 20 February. CarGurus had not responded to the newspaper.","url":"https://www.theregister.com/security/2026/02/18/shinyhunters-claims-it-drove-off-with-17m-cargurus-records/4873029","by":"The Register","patch":"na"}],"url":"https://hard.fyi/live/cargurus-contact-finance-data-breach-feb-2026/","json":"https://hard.fyi/api/live?id=cargurus-contact-finance-data-breach-feb-2026"}