CarGurus

cargurus.com

12,510,981
Exposed Records
Feb 2026
Breach Date
5 months ago
Unknown
Password Risk
Retail industry
Retail
Industry
Added to XposedOrNot on February 23, 2026 · #114 of 763 breaches by records exposed

About This Breach

CarGurus, an automotive marketplace, was targeted in February 2026 by the threat actor ShinyHunters, with data later published publicly exposing over 12M email addresses along with user account IDs, names, phone numbers, physical and IP addresses, and auto finance application outcomes.

Data Exposed

Email addresses
Names
Phone numbers
Physical addresses
IP addresses

Breach Details

Breach Type Data Breach
Searchable Yes
Verified Yes
Sensitive Data No
Reference No reference available

Frequently Asked Questions

When did the CarGurus data breach happen?

CarGurus was breached in Feb 2026. The breach was added to the XposedOrNot index on February 23, 2026.

How many records were exposed in the CarGurus breach?

12,510,981 records were exposed, making it the #114 largest of the 763 breaches in our index.

What data was exposed in the CarGurus breach?

The exposed data includes: Email addresses, Names, Phone numbers, Physical addresses, IP addresses.

What should I do if I was affected by the CarGurus breach?

Change your password on the affected service (and anywhere you reused it), turn on two-factor authentication, and set up free breach alerts on XposedOrNot so you know the moment your email appears in a new breach.

What Should You Do?

High Priority

Enable Two-Factor Authentication

Add 2FA on all supported accounts using an authenticator app like Google Authenticator or Authy.

Recommended

Watch for Phishing Calls & SMS

Be cautious of unexpected calls or texts asking for personal information.

Recommended

Beware of Scam Mail

Be skeptical of unexpected correspondence requesting personal details.

Recommended

Review Device Security

Update your devices and browsers, and check for unauthorized logins.

Recommended

Monitor Your Accounts

Set up login alerts and review account activity regularly for suspicious access.