CarGurus data breach claim (February 2026): what was published
In February 2026 ShinyHunters published an archive it said came from CarGurus. Have I Been Pwned added the data, but CarGurus had not publicly confirmed a breach in the reporting reviewed.
Short answer
Was CarGurus hacked?
Not confirmed by CarGurus. ShinyHunters published an archive it said held more than 12.4 million CarGurus records on 21 February 2026, and Have I Been Pwned added it, finding roughly 70% had appeared in earlier breach collections.
CarGurus had not issued a public breach confirmation in the reporting reviewed. Treat this as a claim backed by published data, not a company-confirmed breach.
Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
CarGurus’s security posture at the time
What CarGurus publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.
Security certifications publicly held
No public certification found.
No public certification found on the company’s own security, trust or compliance pages, in filings, or in the certificate registries searched (BSI, CSA STAR). That is a data point, not proof that none exists.
No reliable report of a share-price move around the disclosure was found.
CarGurus incident timeline, in detail
Confirmed = acknowledged by CarGurus, a regulator filing or a court. Reported = credible reporting CarGurus has not fully confirmed. Unverified claim = an attacker or leak-site claim.
21 Feb 2026Unverified claimExtortion claim / published data
ShinyHunters publishes alleged CarGurus user and finance-application records
What happened. ShinyHunters published an archive it said held more than 12.4 million CarGurus records. Have I Been Pwned added the data and found roughly 70% had appeared in earlier breach collections. CarGurus had not publicly confirmed a breach as of the reporting reviewed.
Impact. Published data reportedly includes emails, names, phone numbers and finance-application details. People or records affected: Claimed 12.4 million records; HIBP analysis suggests about 3.7 million newly exposed (per Security Affairs).
We found no SOC 2 or ISO 27001 certification published by CarGurus. That does not prove it had none; it means none was public.
A claim is not a confirmation
This entry rests on an attacker or leak-site claim the company has not confirmed. Leak sites exaggerate, recycle old data and list victims to pressure them. Treat it as a reason to ask questions, not as an established breach.
What it means for CarGurus CarGurus users and dealers — and what to do
What CarGurus’s customers, partners and security teams can do now, based only on what has been disclosed.
1.Ask in writing, then wait for evidence
Ask the company whether it is aware of the claim and whether any system holding your data is in scope. Do not act on leak-site screenshots alone.
2.Prepare, without assuming
Check what data of yours the company holds so you can move fast if the claim is confirmed.
Not confirmed by CarGurus. ShinyHunters published an archive it said held more than 12.4 million CarGurus records on 21 February 2026, and Have I Been Pwned added it, finding roughly 70% had appeared in earlier breach collections.
Did CarGurus have SOC 2 or ISO 27001 certification?+
We found no SOC 2 or ISO 27001 certification published by CarGurus. That does not prove it had none; it means none was public.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by CarGurus. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout