Breaches and incidentsBriefReported by a reputable outlet, citing the company
CarGurus: 12.5 million accounts published after ShinyHunters extortion
Have I Been Pwned loaded 12.5 million affected email addresses on 22 Feb 2026.
- Disclosed
What happened
- Have I Been Pwned loaded 12.5 million affected email addresses on 22 Feb 2026: names, phone numbers, physical and IP addresses, account ID mappings, auto-finance pre-qualification data and outcomes, and dealer subscription information.
- Root cause: not disclosed.
- HIBP and press attribute it to ShinyHunters; the data was published after a failed extortion attempt.
- HIBP notified subscribers.
Sources
- https://haveibeenpwned.com/Breach/CarGurus
- https://www.cm-alliance.com/cybersecurity-blog/february-2026-recent-cyber-attacks-data-breaches-ransomware-attacks
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.