CarMax carmax.com CarMax data breach: what happened and what to do
In January 2026, data allegedly taken from CarMax was published online after a failed extortion attempt. Have I Been Pwned lists 431,371 accounts with email addresses, names, phone numbers and physical addresses.
View all 13,115 breaches- Breach date
- 24 Jan 2026
- Affected
- 431,371
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In January 2026, data allegedly sourced from the US used-car retailer CarMax was published online after a failed extortion attempt. Have I Been Pwned (HIBP) dates the breach to 24 January 2026 and added it to its database on 20 February 2026.
HIBP counts 431,371 accounts, described as 431k unique email addresses. Alongside the emails, the data includes names, phone numbers and physical addresses. HIBP doesn't list passwords, payment cards or government IDs for this breach.
Reports link the leak to ShinyHunters, a group known for extortion campaigns against large companies.
What that data lets someone do is mostly social engineering. A name, an email address, a phone number and a home address, tied to a car retailer, is enough for a convincing message. Think of a text about a vehicle appointment, a financing offer or an "account problem" that asks you to click a link or read out a code. None of the exposed data types gives anyone direct access to an account, so the risk is being tricked rather than being locked out.
If you bought, sold or financed a car through CarMax, assume your contact details are in circulation and treat unexpected messages that mention CarMax with suspicion.
What to do if you were in it
- 1
Treat messages that mention CarMax with suspicion
Expect emails and texts about appointments, offers or account issues. Don't click the link. Open the CarMax site or app by typing the address yourself.
- 2
Never share one-time codes
A text asking you to read back a verification code is a common follow-up to a leak like this. No real company asks for it.
- 3
Watch for calls that know your address
Your name, phone number and home address were exposed together. Be cautious with callers who use them to sound legitimate, and hang up and call back on a number you look up yourself.
- 4
Use a unique password and 2FA on your accounts
Passwords weren't listed as exposed, but a unique password per site and two-factor authentication limit the damage from any future breach.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one too.
Frequently asked
Was I affected by the CarMax data breach?
If your email address was in the published data, yes. Search it on HIBP, or run a free Serus scan that also checks other breaches.
What was exposed in the CarMax breach?
Email addresses, names, phone numbers and physical addresses, according to HIBP.
How many people were affected?
HIBP lists 431,371 accounts.
Should I change my password?
HIBP doesn't list passwords for this breach, so there is nothing you have to change. It's still a good moment to replace any password you reuse.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
