Verified Breach

Feb 14, 2026 Breach Date

12,461,887 Accounts Affected

5 Data Types Exposed

Feb 21, 2026 Added to HIBP

About This Breach

In February 2026, the automotive marketplace CarGurus was the target of a data breach attributed to the threat actor ShinyHunters. Following an attempted extortion, the data was published publicly and contained more than 12M email addresses across multiple files including user account ID mappings, finance pre-qualification application data and dealer account and subscription information. Impacted data also included names, phone numbers, physical and IP addresses, and auto finance application outcomes.

Compromised Data Types

Email addresses IP addresses Names Phone numbers Physical addresses

Check If You Were Affected

Were you part of the CarGurus breach?

~ digitalchk / breach check

Has your email been exposed in a breach?

I accept the Terms & Conditions*

1. Purpose: This tool checks whether your email address has appeared in publicly known data breaches via the Have I Been Pwned (HIBP) API.

2. Data Collection: Your email address is submitted to HIBP for breach lookup. If lead capture is enabled, your email may also be stored locally for service communication. Your IP address is recorded alongside it and used for rate limiting and abuse prevention. Past the daily limit of free checks, you will be asked for your email address and a 6-digit code we send to it; free checks are counted per IP address, stored in hashed form, for the day.

3. Third-Party Service: This tool relies on Have I Been Pwned (haveibeenpwned.com), an external service. Your email is transmitted to their API. Their privacy policy applies.

4. No Warranty: Results reflect data publicly known at the time of check. Absence does not guarantee your email has never been compromised; presence does not necessarily mean current risk.

5. Email Verification: Submitted addresses may be validated using automated checks (format, MX records, third-party verification services).

6. Data Retention & Privacy: Locally stored data is kept for 90 days and then deleted automatically. Breach monitoring and newsletter subscriptions are kept until you unsubscribe. We do not sell or share personal data with unrelated third parties.

7. Acceptable Use: This tool is provided for personal and business security awareness. Do not use it to check email addresses you do not own or are not authorized to verify.

8. Breach Monitoring (optional): You can only monitor an address you manage. If you turn it on and confirm with a code sent to that address, we store it with the list of breaches it already appears in, check it with HIBP periodically, and email you only if it appears in a new breach. Turning on monitoring also subscribes you to our newsletter, and unsubscribing from any of our emails stops the monitoring and deletes the record. To monitor the addresses of your staff or clients, contact us.

9. Changes: These terms may be updated at any time. Continued use constitutes acceptance.

A tool by Digital Checkmark

CarGurus Data Breach

Has your email been exposed in a breach?