CarGurus data breach affects 12.5 million accounts

In a significant data breach, CarGurus, a prominent online automotive marketplace, has reported that sensitive information belonging to 12.5 million customers has been compromised. This incident, which includes names, email addresses, phone numbers, and physical addresses, has raised serious concerns about data security in the automotive sector. The breach was highlighted by the data notification platform, Have I Been Pwned, founded by security expert Troy Hunt. According to the platform, the hacking group ShinyHunters is behind this cyberattack. Known for their adept social engineering tactics, ShinyHunters has previously infiltrated various organizations by impersonating employees and manipulating helpdesk personnel to reset passwords. This group has a notorious history, having extracted data from multiple universities and acquiring over a billion records from Salesforce clients, including major companies such as Google and Workday. Their recent exploits also include claims of breaches at adult site Pornhub and fintech company Figure. The data released in this breach encompasses critical information such as user account ID mappings and finance pre-qualification application details, alongside dealer account and subscription data, as reported by Have I Been Pwned. This incident marks the second major automotive-related data breach reported this year, following a previous breach involving CarMax, which saw the exposure of data from approximately 431,000 unique email addresses. TechCrunch has reached out to CarGurus for a statement regarding this alarming breach and will provide updates as more information becomes available.