ShinyHunters-Linked Extortion and Data Leak Claims Targeting Automotive Retailers

Data allegedly sourced from US automotive retailer CarMax was published online after a failed extortion attempt, according to a Have I Been Pwned breach entry. The exposed dataset reportedly includes 431,000 unique email addresses along with names, phone numbers, and physical addresses, indicating a PII-heavy leak that could enable targeted phishing and identity-focused fraud.

Separately, CarGurus was reported as being purportedly breached by the ShinyHunters hacking operation, with claims of 1.7 million corporate files stolen and an extortion deadline tied to negotiations. The intrusion was alleged to have occurred via single sign-on (SSO) codes obtained through voice phishing, consistent with ShinyHunters’ prior claims of compromising other organizations using SSO-code access; CarGurus has been positioned as another extortion-driven theft where internal records and PII may be at risk of exposure.