ShinyHunters Claim CarGurus Data Leak Affecting 12.4 Million Records
Summary
ShinyHunters published an archive it claims contains 12.4 million CarGurus records. Have I Been Pwned added the dataset and reported about 3.7 million records were new. CarGurus has not issued an official breach statement.
Key points
- ShinyHunters claimed the 6.1GB archive published on February 21 contained 12.4 million CarGurus records.
- Reported data includes contact details, IP addresses, account IDs, finance application information, dealer details, and subscription information.
- Have I Been Pwned added the dataset and reported that about 3.7 million records were not already in its database.
- CarGurus had not issued an official breach statement or responded to BleepingComputer’s request for comment.
- The article warns that freely downloadable personal information could be used in phishing and scams; it does not establish how the data was obtained.
Article Details
- Victim Organization
- CarGurus
- Incident Type
- Alleged data breach and public data leak
- Data Types Exposed
- Email addresses
- IP addresses
- Full names
- Phone numbers
- Physical addresses
- User account IDs
- Finance pre-qualification application data
- Finance application outcomes
- Dealer account details
- Subscription information
- Affected Records
- ShinyHunters claimed the archive contained 12.4 million CarGurus records. Have I Been Pwned reported that roughly 3.7 million records were new to its database.
- Affected Data Size
- 6.1GB archive, according to the report
- Operational Impact
- No operational disruption was reported. The archive was described as freely downloadable, creating a potential phishing and scam risk.
- Ransom Or Extortion
- ShinyHunters, described as an extortion group, published the archive. No incident-specific ransom demand or negotiation details were reported.
- Claim Status
- claimed
Threat Actors
Countries
CanadaCarGurus is a publicly traded automotive research and shopping company that operates in the U.S., Canada, and the U.K.United StatesThe ShinyHunters extortion group has published personal information in more than 12 million records allegedly stolen from CarGurus, a U.S.-based digital auto platform.