ShinyHunters Leaks 12.4 Million CarGurus Records in Massive Data Breach The ShinyHunters extortion group has released over 12 million records allegedly stolen from CarGurus, a U.S.-based digital automotive marketplace serving millions across the U.S., Canada, and the U.K. The breach, disclosed on February 21, involved a 6.1GB archive containing sensitive user data, including: - Email and IP addresses - Full names and phone numbers - Physical addresses - User account IDs - Finance pre-qualification and application details - Dealer account information - Subscription data HaveIBeenPwned (HIBP) verified and added the dataset to its database, confirming that 3.7 million records were new, while the remaining 70% overlapped with prior breaches. Though CarGurus has not officially acknowledged the incident, the leaked data is now publicly accessible, raising concerns about phishing and fraud risks for affected users. ShinyHunters, known for aggressive extortion tactics, has recently targeted multiple high-profile companies, including Odido, Optimizely, Figure, Canada Goose, Panera Bread, Match Group, and SoundCloud. The group typically gains access through social engineering, such as voice phishing, tricking employees into exposing credentials or installing malicious OAuth apps that grant API-level access to platforms like Salesforce, Okta, and Microsoft 365. This breach underscores the growing threat of data extortion groups exploiting corporate systems to harvest and leak sensitive customer information.