2026 CarGurus — 12.4M records (ShinyHunters)
Data compromised
Emails, names, phones, addresses, IP addresses, user IDs, finance pre-qualification data, dealer account info
Technical writeup
ShinyHunters breached CarGurus via voice phishing targeting Okta, Microsoft, and Google SSO (Feb 13, 2026). Initial claim: 1.7M corporate records. When ransom was refused, ShinyHunters published 12.4–12.5M records including email addresses, names, phone numbers, physical addresses, IP addresses, user IDs, finance pre-qualification data, and dealer account info. Vehicle marketplace confirmed breach and contained affected environment.
Root cause
Voice phishing; SSO credential theft (Okta, Microsoft, Google)
References
- https://techcrunch.com/2026/02/24/cargurus-data-breach-affects-12-5-million-accounts/
- https://www.bleepingcomputer.com/news/security/cargurus-data-breach-exposes-information-of-124-million-accounts/
- https://cybernews.com/security/shiny-hunters-car-gurus-12-4m-records-data-dump/
- https://haveibeenpwned.com/Breach/CarGurus