ShinyHunters leaks alleged CarGurus records

Online car shopping platform CarGurus had a 6.1GB stolen archive containing 12.4 million records posted online by the ShinyHunters extortion group on Feb. 21, BleepingComputer reports.

Such a dataset, which has since been added to breach tracking and notification site Have I Been Pwned, includes email and physical addresses, full names, IP addresses, phone numbers, account IDs, subscription data, and finance pre-qualification and outcome records, as well as dealer details. Because the archive is freely available for download, security experts warn it could be used for scams and phishing campaigns.

HIBP said about 70% of the records were already in its system from earlier breaches, leaving roughly 3.7 million new entries. ShinyHunters has recently claimed multiple high-profile breaches and often uses social engineering tactics, including voice phishing, to gain access to corporate systems and SaaS platforms. CarGurus has not confirmed a breach and did not respond to requests for comment.