Data breach
Car Gurus data breach
In 2026, Car Gurus suffered a data breach affecting 16,598,807 records. Exposed data included names, surname, email addresses and 6 other types of data.
Breach date
16.6 million
Records in the breach
9
Types of data exposed
Were you affected by the Car Gurus breach?
Enter your email address to see whether it appears in this breach — or any of the other breaches in Leak Database.
Data exposed in the Car Gurus breach
- Names
- Surname
- Email Addresses
- Phone Numbers
- IP Addresses
- Account Information
- Finance Applications
- Addresses
- Financial Information
About the breach
The online automotive marketplace CarGurus suffered a major data breach in February 2026, which exposed records belonging to approximately 12.4 to 12.5 million user accounts.
Key Details of the Incident
• Attacker / Attribution: The breach was claimed by the ShinyHunters extortion group, which published a compressed archive (roughly 6.1 GB) containing millions of user records on a Tor-based leak site after an attempted extortion.
• Compromised Data: The leaked files and data sets included:
• Names, email addresses, phone numbers, and physical addresses
• IP addresses and user account ID mappings
• Auto finance pre-qualification application data and application outcomes
• Dealer account and subscription information
• Cause: Reports indicate the incident stemmed from social engineering rather than a direct technical vulnerability or malware intrusion.
• CarGurus’s Response: CarGurus stated that the incident was limited and contained, and that core systems, APIs, and dealer data feeds were not compromised.
Key Details of the Incident
• Attacker / Attribution: The breach was claimed by the ShinyHunters extortion group, which published a compressed archive (roughly 6.1 GB) containing millions of user records on a Tor-based leak site after an attempted extortion.
• Compromised Data: The leaked files and data sets included:
• Names, email addresses, phone numbers, and physical addresses
• IP addresses and user account ID mappings
• Auto finance pre-qualification application data and application outcomes
• Dealer account and subscription information
• Cause: Reports indicate the incident stemmed from social engineering rather than a direct technical vulnerability or malware intrusion.
• CarGurus’s Response: CarGurus stated that the incident was limited and contained, and that core systems, APIs, and dealer data feeds were not compromised.
How to protect yourself
In order to protect yourself, we recommend the following:
1. Monitor your credit report for any suspicious activities. If you cannot do this yourself, make use of any service that does this on your behalf.
2. Be on the lookout for an increase in number of spam or scam calls and emails. We recommend you make use of Apps like True Caller, which can assist you in identifying any possible spam or scam calls.
3. Be sure to monitor your bank account transactions. Ensure you receive real time notifications on any transaction.
1. Monitor your credit report for any suspicious activities. If you cannot do this yourself, make use of any service that does this on your behalf.
2. Be on the lookout for an increase in number of spam or scam calls and emails. We recommend you make use of Apps like True Caller, which can assist you in identifying any possible spam or scam calls.
3. Be sure to monitor your bank account transactions. Ensure you receive real time notifications on any transaction.
Get told about the next breach
A free Leak Database account emails you when your address appears in a newly added breach.