CarGurus confirms data breach affecting 12.5 million accounts

Automotive marketplace CarGurus, which was founded in 2006, was the target of a data breach in which the names, email addresses, phone numbers, and physical addresses of millions of customers were stolen. Have I Been Pwned, a data-breach notification site provided by security researcher Troy Hunt, reported that 12.5 million CarGurus accounts were compromised in the data breach. CarGurus operates an online marketplace that allows customers to buy, sell, and finance vehicle purchases. According to Have I Been Pwned, the customer data that was published included user account ID mappings, finance prequalification application data, and dealer account and subscription information. CarGurus did not dispute the figure reported by Have I Been Pwned.

CarGurus spokesperson Maggie Meluzio confirmed that the company experienced a cybersecurity incident, which is now contained. Meluzio stated: “there are no indications that dealer data feeds, APIs, or core systems or products used by our consumers or dealer partners have been compromised. We remain fully operational, and our services continue without interruption. We will notify any affected individuals in accordance with applicable laws”. The report was updated on Wednesday with this comment from CarGurus.

Have I Been Pwned attributed the breach to the hacking group ShinyHunters. The group is “known for its social engineering skills”, such as calling up help desks and pretending to be employees who need their password reset. The hackers have used these social engineering skills to steal reams of data from several universities and over a billion records from Salesforce customers, including Google and Workday. The group has also claimed recent hacks at Pornhub and fintech lending company Figure.

This is the second automotive-related data breach reported by Have I Been Pwned this year. Last month, the data-breach notification site reported that data allegedly from automotive company CarMax was published following a failed extortion attempt. The data breach involving CarMax included about 431,000 unique email addresses along with names, phone numbers, and physical addresses.

Why it matters

This incident marks the second automotive-related data breach reported by Have I Been Pwned this year, signaling a concerning trend of security vulnerabilities within the sector following the CarMax incident.