According to BleepingComputer, ShinyHunters published a 6.1GB archive with 12.4 million records on February 21, saying it came from CarGurus [2]. According to TechCrunch, Have I Been Pwned counted 12.5 million affected accounts with names, emails, phone numbers and addresses, and a CarGurus spokesperson confirmed a cybersecurity incident that is now contained [1]. BleepingComputer advises CarGurus users to stay alert for malicious communications and scams leveraging the leaked information [2].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Feb 21, 2026 and we added it on Nov 11, 2026. It is not a new event.
HighMonitoringBackfillMedia reported
US auto marketplace CarGurus data published by ShinyHunters, about 12.5 million accounts affected
1 min read
- Disclosed
- Feb 21, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- Scale
- 12,500,000 accounts[1]
- CVSS basis
- Our assessment
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Retail
What to do nowOur advice
- Stay alert for malicious messages and scams that use the leaked CarGurus data [2].
Timeline
Technical details
Remediation
Vendor guidance
- 1Watch for scams verify[2]
Watch for malicious messages and scams using the leaked data.
References
Media2
- [1]TechCrunch2026-02-24Accessed 2026-11-11Snapshot 2026-11-11 sha256 510a9535871d
“CarGurus spokesperson Maggie Meluzio confirmed to TechCrunch that the company experienced a cybersecurity incident, which is now contained.”
- [2]BleepingComputer2026-02-24
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.