CarGurus Data Breach: 12.5M Accounts, What to Do
TL;DR · the short version
CarGurus confirmed a contained cybersecurity incident in February 2026. The extortion group ShinyHunters claimed it, first saying it had taken 1.7 million corporate records, and later published an archive that Have I Been Pwned counts as 12.5 million affected addresses. HIBP lists names, email addresses, phone numbers, physical addresses and IP addresses, plus files with finance pre-qualification data and dealer account information. CarGurus did not dispute the HIBP figure, told TechCrunch the incident was contained, and told dealers the data mainly included publicly available dealer names and contact details. Class actions were filed in Massachusetts on 26 February 2026. The vishing method is the group's claim and is unconfirmed.
CarGurus, the online car marketplace, confirmed a cybersecurity incident in February 2026, and data from it is now public. The extortion group ShinyHunters listed CarGurus on its leak site on 18 February, claiming 1.7 million corporate records taken on 13 February. After the group's deadline passed, a larger archive appeared, and Have I Been Pwned (HIBP) added it on 22 February, counting 12.5 million affected addresses. CarGurus did not dispute that figure and told TechCrunch the incident was contained. What is claimed (the group's record count and its method, voice phishing for single sign-on codes) is separate from what CarGurus has confirmed. We found no official CarGurus count and no regulator filing.
Confirmed vs not yet known
- CarGurus states: a spokesperson, Maggie Meluzio, confirmed a cybersecurity incident, said it is contained, said dealer data feeds, APIs and core systems were not indicated as compromised, that CarGurus "remain[s] fully operational", and that it "will notify any affected individuals in accordance with applicable laws" (as reported by TechCrunch, 24 Feb 2026).
- CarGurus told dealers (notice dated 1 May 2026) that it had "completed our investigation with the assistance of a leading independent cybersecurity firm", that "the incident was limited in scope and contained", and that "The data mainly included publicly available dealer names and contact details." The notice gives no number of people.
- Have I Been Pwned states: the data was attributed to ShinyHunters, published after an attempted extortion, and includes more than 12 million email addresses across multiple files. HIBP lists 12.5 million affected addresses. This is a breach-notification service's count of the leaked files, not a CarGurus figure.
- Claimed, not confirmed: ShinyHunters said it stole 1.7 million corporate records on 13 February using voice phishing to obtain single sign-on codes (The Register, 18 Feb). CarGurus has not confirmed the method, the date or that figure in anything we found.
- Not known: how many people CarGurus itself says are affected, whether Social Security numbers or passwords were involved (HIBP lists neither), the initial access route, and whether CarGurus has sent consumer notification letters. We found no SEC 8-K, no state attorney general filing and no consumer letter.
What data was exposed
These are HIBP's descriptions of the published files, not CarGurus's:
- Data classes listed: email addresses, IP addresses, names, phone numbers and physical addresses.
- Files described: user account ID mappings, finance pre-qualification application data (with application outcomes) and dealer account and subscription information.
- Overlap with older leaks: HIBP said on X, as quoted by SecurityWeek, that roughly 70 percent of the email addresses were already in its database from other breaches.
CarGurus's dealer notice describes the data as mainly publicly available dealer names and contact details, and says "If you have not been contacted, sensitive information from individuals working at your dealership was not affected." Dealers whose sensitive information was involved "in rare cases" were contacted directly. The notice does not address consumer accounts, so we cannot reconcile it with HIBP's consumer-facing counts.
How many people: where the figures differ
| Figure | Who says it | Status |
|---|---|---|
| 1.7 million "corporate records" | ShinyHunters, via The Register (18 Feb) | Attacker claim, unverified |
| 12.5 million affected addresses ("more than 12M email addresses") | Have I Been Pwned | Count of the leaked files; CarGurus did not dispute it (TechCrunch) |
| About 12.4 million records in a 6.1 GB archive | Press reports of the leak | Different counting of the same archive |
| Not stated | CarGurus dealer notice | No number given |
One headline in a class-action news roundup says 1.2 million consumers while its own text says 12.5 million; we treat that as a typo and do not use it.
Timeline
| Date (2026) | Event | Source |
|---|---|---|
| 13 Feb | ShinyHunters says it gained access on this date (claim) | The Register |
| 18 Feb | ShinyHunters lists CarGurus on its leak site, claims 1.7 million records and sets a 20 February deadline. CarGurus had not responded to The Register. | The Register |
| Around 21 Feb | A 6.1 GB archive is published after the extortion attempt fails (press reports date it to 21 February) | SecurityWeek (6.1 GB); date per press reports |
| 22 Feb | HIBP adds the data. CarGurus emails primary dealership contacts the same day. | HIBP; CarGurus dealer notice |
| 24 Feb | TechCrunch reports 12.5 million accounts and quotes CarGurus confirming a contained incident | TechCrunch |
| 25 Feb | SecurityWeek reports CarGurus had not publicly acknowledged the incident when it published | SecurityWeek |
| 26 Feb | Ramirez and Infield class actions filed in the District of Massachusetts | Top Class Actions |
| 1 May | CarGurus dealer notice: investigation complete, incident "limited in scope and contained" | CarGurus dealer notice |
| 27-28 Jul | Plaintiffs tell the court they will voluntarily dismiss the consolidated case without prejudice | Bloomberg Law (28 Jul) |
Timing note: the SecurityWeek and TechCrunch reports are a few days apart and differ on whether CarGurus had acknowledged the incident. TechCrunch's article carries a later comment from CarGurus, so we treat the company's confirmation as dating from that update.
Useful next, if this was relevant to you
Lawsuits
Top Class Actions reports that David Ramirez and Nancy Infield each sued CarGurus on 26 February 2026 in the US District Court for the District of Massachusetts (Ramirez v. CarGurus Inc., No. 1:26-cv-11003; Infield v. CarGurus Inc., No. 1:26-cv-10996). They allege that CarGurus failed to use reasonable data security and gave no response or notice about the breach, and assert negligence, breach of implied contract, unjust enrichment and declaratory relief; Ramirez also cites the California Consumer Privacy Act. These are allegations, not findings. A further suit, Campbell v. CarGurus, is reported by a claims-tracking site to have been filed on 6 March; we could not confirm it from a court record. Bloomberg Law reported on 28 July that the plaintiffs in the consolidated case were dropping it without prejudice, so it could be refiled.
What the attackers say, and why to treat it carefully
According to The Register, ShinyHunters wrote that it was issuing a "final warning to reach out by 20 Feb 2026 before we leak", and said it got in through voice phishing that obtained single sign-on codes. The same reporting calls this part of a broader campaign against Okta, Microsoft and Google sign-in flows. That is the group's description of its own method. SecurityWeek says it is unclear how the data was stolen, and CarGurus has not described the access route in any source we found. Do not repeat the method as established fact.
What affected people should do
- Check your email on Have I Been Pwned to see whether it is in the CarGurus dataset.
- Change your password on affected accounts and anywhere you reused it. HIBP's page also advises enabling two-factor authentication where supported and using a password manager.
- Treat unexpected contact as suspect. CarGurus's own notice tells dealers to be cautious of unsolicited emails, not to click links or open attachments from unknown senders, and that emails claiming your information was compromised are "most likely scams". Do not reply, click, open attachments or send payment.
- Prefer an authenticator app or key to SMS for two-factor codes, as CarGurus's dealer guidance does.
- If you applied for financing through the site, watch for calls or messages that quote your application details. Because finance pre-qualification data is described in the leak, contact the lender or dealer through a number you look up yourself.
- Dealers: CarGurus says dealer passwords were not compromised and gives Support@CarGurus.com for help updating credentials.
What security leaders should do this week
- Harden help desk and sign-in recovery. The claimed method is vishing for SSO codes. Require strong out-of-band identity proofing before any reset or code release, and brief staff on voice phishing.
- Move off SMS and one-time codes that can be read out. Prefer phishing-resistant authentication for administrators and anyone with SSO admin rights.
- Alert on SSO anomalies. New device enrolment, unusual token issuance and bulk exports from SaaS apps should page someone. Test that your detections would catch it in the Detection Lab.
- Prepare for a leak you did not cause. Marketplaces hold finance and contact data. Rehearse the first 48 hours with the customer database breach lab and work through the data breach response checklist.
- Know your notification clocks. Work out which deadlines apply in your jurisdictions with the breach notification clock calculator, and decide who confirms facts publicly. An extortion listing should not drive your wording.
- Check your own exposure. If employees used work email on CarGurus, expect phishing that references car purchases. Add the dataset to your credential-exposure monitoring.
More on this incident
- CarGurus breach timeline in our breach index.
- February 2026 data breaches and cyber attacks: roundup, which covers CarGurus alongside the month's other incidents.
FAQ
Was CarGurus hacked?
CarGurus confirmed a cybersecurity incident. In a statement quoted by TechCrunch on 24 February 2026, spokesperson Maggie Meluzio said the incident was contained, that dealer data feeds, APIs and core systems were not indicated as compromised, and that CarGurus would notify affected individuals in accordance with applicable laws. The extortion group ShinyHunters claimed responsibility; that attribution is the group's claim and Have I Been Pwned's, not something CarGurus has confirmed in the sources we found.
How many people were affected by the CarGurus data breach?
Sources differ. Have I Been Pwned (HIBP) lists 12.5 million affected addresses and describes "more than 12M email addresses across multiple files". Some outlets say about 12.4 million records. ShinyHunters first claimed 1.7 million corporate records. TechCrunch reported that CarGurus did not dispute the HIBP figure. We found no official count from CarGurus.
What data was exposed in the CarGurus breach?
HIBP lists email addresses, IP addresses, names, phone numbers and physical addresses. It describes files with user account ID mappings, finance pre-qualification application data (including application outcomes) and dealer account and subscription information. HIBP does not list passwords or Social Security numbers among the data classes, and we found no source from CarGurus saying they were involved.
How do I know if my CarGurus data was leaked?
Search your email address on Have I Been Pwned. If it appears in the CarGurus breach, treat any email, call or text that mentions your car search, finance application or dealer as possibly targeted. HIBP said about 70 percent of the addresses were already in its database from other breaches, so an appearance does not prove this incident was the only source of your data.
Did CarGurus send breach notification letters?
We could not find one. As of 9 November 2026 we found no CarGurus notice to consumers, no state attorney general filing and no SEC 8-K about the incident. CarGurus published a dealer-facing notice dated 1 May 2026 and told TechCrunch it would notify affected individuals as required by law. If you receive a letter, follow its instructions.
Has CarGurus been sued over the data breach?
Yes. Top Class Actions reports that proposed class actions Ramirez v. CarGurus Inc. (No. 1:26-cv-11003) and Infield v. CarGurus Inc. (No. 1:26-cv-10996) were filed in the US District Court for the District of Massachusetts on 26 February 2026, alleging negligence and failure to give notice. Bloomberg Law reported on 28 July 2026 that plaintiffs in the consolidated case were voluntarily dismissing it without prejudice, which means it can be refiled. Its text did not show a reason.
What should I do if I used CarGurus?
Change your CarGurus password and any account that shares it, turn on two-factor authentication, use a password manager, and be cautious with unsolicited emails, calls and texts. CarGurus tells dealers to ignore emails claiming their information was compromised because they are "most likely scams". Never pay or send information to someone who contacts you about the leak.
Sources
- Have I Been Pwned: CarGurus data breach (added 22 Feb 2026), data classes, files and the 12.5 million count
- CarGurus: cybersecurity incident information for dealers (dated 1 May 2026), the company's own statement
- TechCrunch: CarGurus data breach affects 12.5 million accounts (24 Feb 2026), including the CarGurus spokesperson statement
- The Register: ShinyHunters claims it drove off with 1.7M CarGurus records (18 Feb 2026), the group's claims
- SecurityWeek: Over 12 million users impacted by CarGurus data breach (25 Feb 2026)
- Top Class Actions: class actions claim CarGurus data breach (16 Mar 2026), docket numbers and allegations
- Bloomberg Law: CarGurus consumers drop lawsuit over ShinyHunters data breach (28 Jul 2026)
This article is educational guidance for security leaders, not legal advice or a forensic report. PlayCISO is independent and not affiliated with CarGurus. Check the sources above for the latest details.