CarGurus
Data Breach on February 20, 2026
| Data Breach Report | |||
|---|---|---|---|
| Victim | cargurus.com | ||
| Threat Actor | ShinyHunters | ||
| Date Discovered | Feb 20, 2026 | ||
| Description | CarGurus, Inc. is an online automotive marketplace company based in the USA (Massachusetts), providing vehicle listings, pricing analytics, and dealer services. | ||
| Leak Size | Unknown |
Credential Exposure for cargurus.com
We've indexed 201 @cargurus.com accounts from external breaches, plus 10,668 credentials for cargurus.com itself.
Last checked Aug 16, 2026
| @cargurus.com addresses from external breaches | |
|---|---|
| Third-party breaches | 168 accounts · across 37 breaches · 163 with a plaintext password · most recent Jan 31, 2026 |
| Combo lists | 40 accounts · most recent Aug 7, 2026 |
| Passwords for cargurus.com accounts | |
|---|---|
| Combo lists | 9,344 logins · most recent Aug 15, 2026 |
| Infostealer logs | 2,619 logins · 2,047 infected devices · most recent Aug 8, 2026 |
Logins may belong to customers or to staff, and the data doesn't say which. None of this is necessarily connected to the ransomware attack above.
Is your organization next?
CarGurus was breached. Check if your company's credentials have been exposed in this or other data breaches.
Check your exposure →Continuous dark web monitoring alerts you when we find leaked credentials or session tokens for your company.