Reports have emerged that online car marketplace CarGurus has been targeted by the hacking group ShinyHunters, with claims that more than 12 million email addresses appear across leaked data files.
We have already been contacted by individuals concerned that their personal information may have been caught up in the breach.
Here’s what we know so far, and what it could mean if you’re affected.
What has been reported?
According to posts on the group’s data leak site and coverage in the technology press, ShinyHunters claims to have breached CarGurus systems in February 2026.
The group alleges it extracted around 1.7 million corporate records. However, breach-monitoring sources suggest the wider dataset may include more than 12 million email addresses across multiple files, alongside other personal information.
The attackers are also said to have issued an ultimatum, warning CarGurus to respond before a deadline or risk having the data published on the dark web, a tactic commonly associated with ransomware-style extortion.
Based on reports so far, the exposed data could include:
- Names
- Email addresses
- Phone numbers
- Physical addresses
- IP addresses
- Finance pre-qualification application data
- Dealer account and subscription information.
How did the attack happen?
Security experts have linked this incident to a broader campaign of “vishing” attacks attributed to ShinyHunters.
Vishing — short for voice phishing — involves attackers impersonating IT staff over the phone. Employees are persuaded to reset login credentials or reveal multi-factor authentication (MFA) codes.
Once access to a single sign-on system is gained, attackers can move across internal systems and extract large volumes of data.
Several well-known organisations have reportedly been targeted using similar tactics in recent months.
What harm could this cause?
If your information was included, you could face:
- Increased phishing emails designed to look like legitimate car finance or dealership communications
- Scam phone calls using personal details to appear convincing
- Identity fraud, particularly if address and date-of-birth information were involved
- Financial scams linked to finance pre-qualification data
- Account takeover attempts if email addresses are reused elsewhere.
Cybercriminals often combine breached datasets with information from other leaks to build detailed profiles of individuals. That makes subsequent scams more sophisticated and harder to spot.
For many people, the impact is not just financial. The stress and uncertainty caused by a data breach can be significant.
Since reports of the alleged breach emerged, we have been contacted by individuals who believe their data may have been exposed.
Can you claim compensation?
Under UK data protection law, organisations must take appropriate technical and organisational measures to protect personal data. If it is shown that a company failed to do so, and that failure led to your data being compromised, you may have the right to seek compensation — particularly if you suffered financial loss or distress.
Whether a claim is possible will depend on:
- What data was involved
- How the breach occurred
- Whether appropriate safeguards were in place
- The impact on you personally.
At this stage, the facts are still developing. But if you believe you may have been affected, staying informed is sensible.
What should you do now?
If you have used CarGurus, consider:
- Being cautious about unsolicited emails or calls referencing car purchases or finance
- Checking your accounts for unusual activity
- Using strong, unique passwords and enabling multi-factor authentication where possible
- Monitoring your credit file if finance data may have been involved.
And if you want to stay updated on any regulatory findings or potential legal action with one of our partner law firms, you can register your interest with Join the Claim.
As more verified information becomes available, we will continue to update our coverage.
Join the Claim connects consumers with SRA-regulated lawyers. Visit the claim page to check your eligibility if a claim is open with one of our trusted legal partners. If a group action has not yet been launched, you can register your interest and we’ll keep you informed if a partner firm decides to take a claim forward.
