ShinyHunters Leaks 12.4M CarGurus Records After Failed Extortion

ShinyHunters dumped 6.1GB CarGurus data exposing 12.4M accounts on February 21, 2026. HIBP verified 3.7M fresh records including emails, names, phones, addresses, finance apps. No official CarGurus confirmation despite BleepingComputer inquiries.

U.S. automotive platform serves 40M monthly visitors across U.S., Canada, U.K. Dealer accounts, subscriptions, finance pre-qual data compromised alongside PII. 70% records previously leaked but fresh subset heightens phishing risks.

ShinyHunters vishing campaigns targeted Salesforce helpdesks for initial access. OAuth apps granted API reads of customer tables previously. February spree includes Odido, Optimizely, Figure, Canada Goose, Panera, Match Group, SoundCloud.

Credential harvesting pages tricked employees into SaaS platform logins. No ransomware demands met leading to public dumps. Phishing, fraud potential massive from combined datasets.

CarGurus annual revenue $907M underscores breach scale. Social engineering remains group’s signature bypassing technical defenses. 70% repeat data amplifies credential stuffing campaigns.

Exposed Data Table

ShinyHunters February Victims

• Odido: 21M telecom records
• Optimizely: Ad tech platform
• Figure: 1M fintech accounts
• Canada Goose: 600K customers
• Panera Bread: 51M accounts
• Match Group: Dating apps
• SoundCloud: 298M accounts

Users monitor for phishing referencing CarGurus data. Change passwords across services proactively. Dark web monitoring essential post-leak.

User Protection Steps

• Enable 2FA everywhere immediately
• Monitor bank/credit statements
• Ignore unsolicited CarGurus communications
• Scan for malware proactively
• Use unique passwords per service
• Check HIBP notifications regularly

Extortion groups accelerate dump frequency post-negotiation failures. Combined datasets fuel mass fraud operations. Platform silence delays coordinated response.

FAQ