Data breach
CarMax data breach
In 2026, CarMax suffered a data breach affecting 432,057 records. Exposed data included names, surname, email addresses and 3 other types of data.
Breach date
432 057
Records in the breach
6
Types of data exposed
Were you affected by the CarMax breach?
Enter your email address to see whether it appears in this breach — or any of the other breaches in Leak Database.
Data exposed in the CarMax breach
- Names
- Surname
- Email Addresses
- Phone Numbers
- Addresses
- Date of Birth
About the breach
In January 2026, data allegedly sourced from U.S. automotive retailer CarMax was published online following an extortion attempt, exposing approximately 431,000 to 451,000 customer records.
You can check if your email was compromised in the exposure via tools like Have I Been Pwned.
What Data Was Exposed
• Full names
• Email addresses
• Phone numbers
• Physical and billing/mailing addresses
• Birthdates and CRM metadata (in some indexed subsets)
• Note: Initial reports and database analyses indicated that account passwords and payment card numbers were not included in the published datasets.
Background and Context
• The Incident: Threat actors (linked in related campaigns to groups like ShinyHunters / Scattered Lapsus$) targeted customer/database systems (including reports pointing to third-party or CRM-related vectors like Salesforce-hosted environments). After CarMax reportedly declined to pay a ransom demand, the stolen data was leaked on underground or public forums.
• Class Action Lawsuit: In February 2026, a proposed class-action lawsuit was filed against CarMax Auto Superstores Inc. in the U.S. District Court for the Eastern District of Virginia (Grabiec v. CarMax Auto Superstores Inc.), alleging negligence and failure to adequately protect sensitive consumer information.
You can check if your email was compromised in the exposure via tools like Have I Been Pwned.
What Data Was Exposed
• Full names
• Email addresses
• Phone numbers
• Physical and billing/mailing addresses
• Birthdates and CRM metadata (in some indexed subsets)
• Note: Initial reports and database analyses indicated that account passwords and payment card numbers were not included in the published datasets.
Background and Context
• The Incident: Threat actors (linked in related campaigns to groups like ShinyHunters / Scattered Lapsus$) targeted customer/database systems (including reports pointing to third-party or CRM-related vectors like Salesforce-hosted environments). After CarMax reportedly declined to pay a ransom demand, the stolen data was leaked on underground or public forums.
• Class Action Lawsuit: In February 2026, a proposed class-action lawsuit was filed against CarMax Auto Superstores Inc. in the U.S. District Court for the Eastern District of Virginia (Grabiec v. CarMax Auto Superstores Inc.), alleging negligence and failure to adequately protect sensitive consumer information.
How to protect yourself
In order to protect yourself, we recommend the following:
1. Monitor your credit report for any suspicious activities. If you cannot do this yourself, make use of any service that does this on your behalf.
2. Be on the lookout for an increase in number of spam or scam calls and emails. We recommend you make use of Apps like True Caller, which can assist you in identifying any possible spam or scam calls.
3. Be sure to monitor your bank account transactions. Ensure you receive real time notifications on any transaction.
1. Monitor your credit report for any suspicious activities. If you cannot do this yourself, make use of any service that does this on your behalf.
2. Be on the lookout for an increase in number of spam or scam calls and emails. We recommend you make use of Apps like True Caller, which can assist you in identifying any possible spam or scam calls.
3. Be sure to monitor your bank account transactions. Ensure you receive real time notifications on any transaction.
Get told about the next breach
A free Leak Database account emails you when your address appears in a newly added breach.