CarGurus data breach: what happened and what to do

CarGurus is a car shopping marketplace where buyers compare listings and dealers advertise. In February 2026, attackers took data from the company and published it after an extortion attempt failed. Have I Been Pwned (HIBP) added 12,461,887 accounts on 22 February 2026.

What happened

HIBP dates the breach to 14 February 2026. Reporting says the attackers got in through voice phishing, where a caller impersonates someone trusted to talk an employee into giving up access. On 21 February, a 6.1 GB compressed archive with more than 12 million records was published.

CarGurus said it blocked the activity and hired a forensic firm. It also said it was adding safeguards and training and offering free credit monitoring to affected individuals. Some secondary summaries mention other claims, including earlier ones about corporate records. Those are not part of the HIBP numbers here.

What was exposed

HIBP lists five data types: email addresses, IP addresses, names, phone numbers and physical addresses. Press coverage of the leaked files went further and listed account ID mappings, finance pre-qualification data, auto finance application outcomes and dealer account details. Treat those extra items as reported by outlets, not as part of HIBP's list.

What that lets criminals do

Car shoppers are a good target for fraud. A scammer who knows your name, phone number and that you were shopping for a car can pose as a dealer or lender. Expect calls and texts about a vehicle you looked at, a financing offer or a payment problem, sometimes with a deposit request.

If finance pre-qualification or application results were in your record, the risk grows. Knowing that a lender approved or declined someone helps a scammer tailor a pitch, such as a "better rate" offer that asks for a Social Security number or a deposit.

Names, addresses and phone numbers together also support identity theft. Many carriers and banks accept those details as proof of who you are.

IP addresses give a rough location and your internet provider, not your street address. They are low risk alone.

The company's response

CarGurus said it blocked the activity, brought in outside forensic experts, strengthened safeguards and training, and offered free credit monitoring. If you received a notice, take up the monitoring offer.

A credit freeze is the cleanest fix

Because lending and finance details may be involved, a freeze at the credit bureaus is worth doing. It stops new accounts in your name regardless of who holds your data. It also costs nothing and does not affect your score, and you can lift it for a day when you apply for a loan or a new card. If you are mid-purchase on a car right now, lift it only for the lender you chose, and keep every other request on hold. Ask the dealer for the lender's name, then confirm it on the lender's own website.