In mid-February 2026, ShinyHunters claimed to have breached CarGurus, Inc., a major online automotive marketplace serving buyers, dealers, and financing workflows.
After issuing a public extortion demand with a February 20 deadline, the actor released a substantially larger dataset when payment was not made.
Current breach intelligence reflects 12M+ records, far above the initial 1.7M claim, including historical account data extending back to 2006.
CarGurus stated it secured the affected environment and launched a third-party investigation. Final scope assessments may continue to evolve as forensics progress.
Because this dataset intersects with vehicle purchase intent and finance context, downstream phishing and fraud risk is materially elevated.
CarGurus is a U.S.-based automotive marketplace connecting buyers, dealers, and financing partners.
The platform supports:
If you created an account, submitted financing details, inquired about vehicles, or operated a dealership profile, your data may be included.
This incident aligns with recent social-engineering-first campaigns targeting SSO and identity infrastructure rather than direct exploitation of core production systems.
Historical account coverage back to 2006, plus persistent identifiers like email, phone, and address, can sustain long-tail targeting risk.
Status: Confirmed / Data Published
Risk is elevated due to automotive purchase context, finance pre-qualification signals, email + phone pairing, and IP-address linkage.
Automotive marketplaces intersect with credit workflows, which increases criminal monetization potential.
If you believe your information may be included:
In February 2026, ShinyHunters claimed a CarGurus compromise, issued an extortion deadline, and later published a large dataset after non-payment.
Observed fields include email addresses, names, phone numbers, addresses, IP addresses, account metadata, user IDs, and finance-related pre-qualification data.
Current intelligence reflects 12M+ records (shown as 12.5M+), which is materially higher than the initial 1.7M claim.
Yes. Incident status is treated as confirmed with publicly available data, though final forensic scope can still change.
Data circulation is detected and phishing relevance is active. Some exploitation channels (like broad credential-list overlap) remain possible pending further validation.
Rotate reused passwords, enable MFA, watch for automotive financing scams, and monitor credit and account activity over the long term.
Enter your email to check if your data appears in this breach.
Be the first to know when new breaches are disclosed. Free forever.
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request ConsultationCarGurus is a U.S.-based publicly traded company and may have disclosure responsibilities under applicable federal and state requirements when incidents are determined material.
Public statements indicate the affected environment was secured and third-party incident response support was engaged.
Initial breach-size claims and later dataset volume differed, highlighting why incident scope can evolve during forensic review.
Users should not rely only on early estimates when making risk decisions.
This incident matches a broader campaign targeting identity infrastructure through social engineering rather than direct code-level exploitation.
We can validate exposure pathways and map realistic downstream threat vectors.
This was not a passive scrape. It reflects coordinated identity-compromise tradecraft.
© 2026 ObscureIQ. All Rights Reserved.