CarGurus Breach

In February 2026, the automotive marketplace CarGurus was identified as a target of the threat actor group ShinyHunters. The following information summarizes the findings regarding the scale and nature of the data involved in this incident.

Incident Overview

• Total Affected Accounts: Approximately 12.5 million records.
• Discovery Date: The breach was added to major notification services on February 22, 2026, following a public release of the data.
• Leak Method: The data was published publicly after an alleged failed extortion attempt.

Analysis of Compromised Data

The leaked files contained diverse categories of personal and platform-specific information. Key data points included:

• Contact Information: Over 12 million email addresses.
• Personal Identifiers: User names, phone numbers, VINs, and physical addresses.
• Technical Metadata: IP addresses and user account ID mappings.
• Financial & Platform Activity: Finance pre-qualification application data, auto finance application outcomes, and dealer account subscription details.

Threat Actor Background

ShinyHunters is a prolific cybercriminal group that emerged in 2020 and is known for high-volume data theft followed by extortion attempts. Recent activity from the group in 2026 has also targeted other organizations, including:

• Crunchbase: Roughly 2 million records leaked in January 2026.
• Figure.com: A social engineering attack reported in mid-February 2026 involving 2.5 gigabytes of data.
• Betterment: Approximately 1.4 million records listed in early February 2026.

The group has increasingly utilized social engineering, specifically voice phishing (vishing), to gain initial access to corporate cloud environments and SaaS platforms.