CarGurus Customer Data Leak Attributed to ShinyHunters

CarGurus customer data was published online in a leak attributed to the ShinyHunters extortion group, exposing roughly 12.4–12.5 million accounts. A 6.1GB archive was posted and subsequently ingested by Have I Been Pwned (HIBP) after validation checks; HIBP reported the dataset includes email addresses, IP addresses, full names, phone numbers, physical addresses, user account IDs, and additional sensitive business/transactional fields such as finance pre-qualification application data, finance application outcomes, dealer account details, subscription information, and account ID mappings. HIBP indicated about 70% of the data had appeared in prior breaches already tracked by the service, implying roughly 3.7 million records may be newly exposed; the public availability of the dataset increases risk of targeted phishing and fraud using the enriched identity and financing-related attributes.

CarGurus had not publicly confirmed the incident at the time of reporting and did not respond to media requests, while HIBP and reporting attributed the breach to ShinyHunters, a group known for social engineering/vishing-style intrusions and subsequent extortion/leak tactics. Separate ShinyHunters-linked incidents reported in the same period included Wynn Resorts confirming theft of employee data following an extortion threat, and Optimizely disclosing a breach tied to a voice-phishing attack that exposed limited business contact information; these are distinct events and do not change the core CarGurus exposure but reinforce the group’s ongoing operational tempo and reliance on social engineering to obtain access and data for leverage.