Carmax (Partial) Breach

The incident is one of several breaches affecting Salesforce in 2025. A group calling itself "Scattered LAPSUS$ Hunters" released a limited sample of the stolen database on October 3, 2025. The records have since been indexed and anonymized in our search engine.

According to the attackers, the full dataset is scheduled for release on October 10, 2025.

Data found in hackers’ sample - CarMax customer record

🧍 Personal Information

• Full name - ✅ Present
• First name - ✅ Present
• Last name - ✅ Present
• Middle name - ✅ Present
• Birthdate - ✅ Present
• Gender - ⛔ Empty
• Age - ⛔ Empty

📧 Contact Information

• Primary email - ✅ Present
• Mobile phone number - ✅ Present
• Home phone number - ✅ Present
• Other phone number - ✅ Present
• Fax number - ✅ Present
• Do-not-call flags (home, mobile, other) - ✅ Present (all true)
• Do-not-email / do-not-fax flags - ✅ Present (true)
• Text reminder consent flag - ✅ Present (false)
• Ready-to-talk text flag - ✅ Present (false)

🏠 Address / Location Data

• Mailing street, city, state, ZIP, country - ✅ Present
• Other address (duplicate fields) - ✅ Present
• Shipping address - ✅ Present (country only)
• Latitude / longitude - ⛔ Empty
• Billing address - ✅ Present
• State & country codes - ✅ Present

💬 Account & CRM Data

• Account source - ✅ Present (“Web”)
• Lead source - ✅ Present (“Web”)
• Record type - ✅ Present
• Account creation / modification dates - ✅ Present
• SystemModstamp - ✅ Present
• CRM customer ID - ✅ Present (My_KMX_Id)
• Account / record flags (IsPersonAccount, IsPartner, etc.) - ✅ Present
• Customer risk formula - ✅ Present (true)
• Description / lead type - ✅ Present (“Reassignment Lead”)
• Priority record flag - ✅ Present (false)

💳 Communication & Marketing

• Auto text reminder consent date - ✅ Present
• Automated reminder opt-out - ✅ Present (true)
• Email opt-out - ✅ Present (true)
• Fax opt-out - ✅ Present (true)
• SMS / mobile opt-in - ⛔ Empty

⚙️ System Metadata

• Created date - ✅ Present
• Last modified date - ✅ Present
• Last activity date - ✅ Present
• Owner / created by IDs - ⛔ Empty (not included in snippet)
• SystemModstamp - ✅ Present
• Photo URL - ⛔ Empty