CarGurus
SourceHave I Been Pwned
StatusConfirmed breach
AddedFebruary 22, 2026
OccurredFebruary 14, 2026
Accounts affected12,461,887
Domaincargurus.com
What was exposed
Email addressesIP addressesNamesPhone numbersPhysical addresses
What to do if you were affected
- Expect more phishing and spam at this address. Treat messages that reference this company with extra caution.
- Watch for text-message phishing and SIM-swap attempts on your phone number.
- Be wary of targeted scams that use your personal details to sound convincing.
Worried your data is exposed?Take back control of your personal data with Literal.
Protect your data Details
In February 2026, the automotive marketplace CarGurus was the target of a data breach attributed to the threat actor ShinyHunters . Following an attempted extortion, the data was published publicly and contained more than 12M email addresses across multiple files including user account ID mappings, finance pre-qualification application data and dealer account and subscription information. Impacted data also included names, phone numbers, physical and IP addresses, and auto finance application outcomes.
Frequently asked questions
What is the CarGurus data breach?
In February 2026, the automotive marketplace CarGurus was the target of a data breach attributed to the threat actor ShinyHunters . Following an attempted extortion, the data was published publicly and contained more than 12M email addresses across multiple...
When did the data breach happen?
This data breach occurred around February 2026.
How many accounts were affected?
Around 12,461,887 accounts were affected.
What information was exposed?
Exposed data included Email addresses, IP addresses, Names, Phone numbers and Physical addresses.
What should I do if I was affected?
Expect more phishing and spam at this address. Treat messages that reference this company with extra caution. Watch for text-message phishing and SIM-swap attempts on your phone number. Be wary of targeted scams that use your personal details to sound convincing.
Related breaches