In a significant security incident, the digital automotive marketplace CarGurus suffered a data breach that exposed 12.4 million account records.

The breach has been attributed to the ShinyHunters extortion group, which claimed to have stolen the data on February 13 via a sophisticated “vishing” (voice phishing) attack.

Key Details of the Breach

• Scale of Leak: While initial reports estimated 1.7 million corporate records were stolen, the threat group published a 6.1GB archive on February 21 containing 12.4 million unique records.
• Compromised Data: The exposed information includes full names, email addresses, phone numbers, physical addresses, IP addresses, and internal corporate data. Financial pre-qualification data has also been allegedly leaked.
• Method of Attack: The hackers reportedly impersonated IT staff in phone calls to employees, tricking them into providing Single Sign-On (SSO)or Multi-Factor Authentication (MFA) codes.
• Verification: The data was verified and added to the Have I Been Pwned monitoring service on February 22, 2026.