CarGurus breach exposes contact and finance application data linked to 12.5 million email addresses
Published CarGurus data includes about 12.5 million email addresses, contact details and finance application information, according to HIBP. CarGurus says the incident is contained. Treat unexpected car finance messages and payment demands cautiously.
If you used CarGurus, check your email address with Have I Been Pwned and watch for unexpected calls, texts or emails about vehicle purchases or finance. Verify requests directly with CarGurus or your lender using contact details you find independently; do not send money or share security codes in response to unsolicited messages.
What’s happening
Attackers attributed to ShinyHunters published CarGurus data after an extortion attempt in February 2026. Have I Been Pwned records approximately 12.5 million email addresses, alongside names, phone numbers, home and IP addresses, finance pre-qualification applications, application outcomes and dealer information. The initial attacker claim concerned 1.7 million corporate records; that is a different measure from HIBP's email-address count. In its 1 May update, CarGurus said an independent investigation was complete, the affected internal database had been secured and the incident was contained. Its dealer-facing statement described mainly public dealer contact information and limited sensitive data, with affected dealers contacted directly. It said dealer passwords and core systems were unaffected. That statement does not reconcile HIBP's wider findings or establish whether all affected consumers were notified. As of 3 November, the reviewed sources establish publication of the data, but no recovery or removal of it. There is no device update to install.
- What
- Breach
- Affects
- CarGurus automotive marketplace
- Fixed in
- Nothing to patch
- Since
- 18 Feb 2026
- Closed
- 1 May 2026
Timeline
- Vendor revised
CarGurus said its independent investigation was complete and the internal database incident was contained. It said dealer passwords and core systems were unaffected, and dealers whose sensitive information might have been involved had been contacted directly.
- Update
CarGurus says it emailed all primary dealership contacts and published a dealer-facing incident update on this date.
- Update
Have I Been Pwned added the breach, recording approximately 12.5 million email addresses. It identified contact details, IP addresses, finance pre-qualification applications and application outcomes among the published data.
- Wider attacks
According to BleepingComputer's subsequent report, ShinyHunters published a 6.1 GB archive claiming it contained 12.4 million CarGurus records.
- Made publicNothing to patch
The Register reported that ShinyHunters claimed to have stolen 1.7 million CarGurus corporate records and threatened publication unless the company responded by 20 February. CarGurus had not responded to the newspaper.
Sources
- Cybersecurity Incident InformationCarGurus · 1 May 2026
- CarGurus Data BreachHave I Been Pwned · 22 Feb 2026
- ShinyHunters claims it drove off with 1.7M CarGurus recordsThe Register · 18 Feb 2026
- CarGurus data breach exposes information of 12.4 million accountsBleepingComputer · 24 Feb 2026