Connect with us

Technology

CarGurus breach linked to ShinyHunters exposes 12.4M records

Published

on

CarGurus breach linked to ShinyHunters exposes 12.4M records

NEWYou can now listen to Fox News articles!

If you’ve ever searched for a car on CarGurus, your personal information could now be circulating online. A hacking group known as ShinyHunters has published what it claims are 12.4 million records taken from CarGurus, a popular auto shopping platform used by millions of people each month.

The leaked data includes names, phone numbers, email addresses, physical addresses and even finance pre-qualification details. While most of the records were already exposed in past incidents, about 3.7 million are newly added to the pile. That means fresh data is now freely available for criminals to download.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

149 MILLION PASSWORDS EXPOSED IN MASSIVE CREDENTIAL LEAK

Advertisement

A hacker group known as ShinyHunters claims it leaked 12.4 million records linked to the car shopping platform CarGurus. (Wei Leng Tay/Bloomberg via Getty Images)

What you need to know about the CarGurus breach

The group behind the leak, ShinyHunters, published a 6.1GB file on Feb. 21, claiming it came from CarGurus. The file allegedly contains 12.4 million user records tied to the U.S.-based auto research and shopping platform CarGurus.

CarGurus operates in the U.S., Canada and the U.K., and its website attracts an estimated 40 million monthly visitors. It allows you to compare vehicles, contact sellers, and, in some cases, apply for financing.

According to Have I Been Pwned, which later added the dataset to its breach database, the exposed information includes email addresses, IP addresses, full names, phone numbers, physical addresses, account IDs, dealer details, subscription information and finance pre-qualification application data, along with outcomes.

Have I Been Pwned reports that about 70% of the data had already appeared in previous breaches. Roughly 3.7 million records are new. CarGurus has not released an official statement confirming the incident and did not respond to media requests for comment. ShinyHunters is known for leaking company data when ransom negotiations fail. The group has recently claimed attacks on major brands across telecom, retail, finance, and tech.

Advertisement

How it works and why it matters to you

ShinyHunters typically gains access by tricking employees, not by smashing through firewalls. In past cases, the group used phone calls or fake login pages to convince staff to hand over credentials. Once inside, attackers can quietly access cloud systems that store customer data.

In some campaigns, they also convinced employees to install malicious apps that granted access to customer databases. That means attackers could read stored information without triggering obvious alarms. If this dataset is legitimate, criminals now have detailed personal profiles tied to car shopping and financing activity, which is valuable.

Finance pre-qualification data is especially sensitive. Even if it does not include full Social Security numbers, it signals that you were actively sharing financial details. That makes you a prime target for follow-up scams, identity theft attempts and fake loan offers. Because the data is publicly available for download, it does not take much skill for criminals to start using it.

“We recently experienced a cybersecurity incident,” a CarGurus spokesperson told CyberGuy. “We promptly responded by securing the affected environment, and we are currently working with a leading cybersecurity firm to investigate. Based on the investigation to date, we believe the activity has been contained and limited in scope. Also, at this time, there are no indications that dealer data feeds, APIs, or core systems or products used by our consumers or dealer partners have been compromised. We remain fully operational, and our services continue without interruption. We will notify any affected individuals in accordance with applicable laws.”

DATA BREACH EXPOSES 400,000 BANK CUSTOMERS’ INFO

Advertisement

7 ways you can protect yourself from the CarGurus breach

Here’s what you can do right now to reduce your risk and stay ahead of potential scams tied to this leak.

1) Check if your email and passwords are compromised

To see if your email was affected, visit Have I Been Pwned at haveibeenpwned.com. Enter your email address to find out if your information appears in the CarGurus leak. When done, come back here for Step 2.

The exposed dataset reportedly includes names, emails, phone numbers, addresses and finance pre-qualification details. (Felix Zahn/Photothek via Getty Images)

2) Change your passwords immediately

Start with your most important accounts, such as email, medical and banking. Use strong, unique passwords with letters, numbers and symbols. Avoid predictable choices like names or birthdays. Never reuse passwords. One stolen password can unlock multiple accounts.  A password manager makes this simple. It stores complex passwords securely and helps you create new ones. Many managers also scan for breaches to see if your current passwords have been exposed. Use a password manager to generate strong, unique passwords for every account and store them securely. That way, if one account is exposed, criminals can’t use the same password to access the rest of your accounts. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

3) Reduce your online exposure with a data removal service

You can also consider a personal data removal service. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Advertisement

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

4) Turn on two-factor authentication

If CarGurus or your email provider offers two-factor authentication (2FA), enable it. This adds a second step, like a code sent to your phone, making it much harder for someone to access your account even if they have your password.

5) Watch for finance-related phishing scams

Be extra cautious with emails or texts about car loans, financing approvals, or dealership follow-ups. Do not click links in unsolicited messages. Instead, contact the company directly using the official contact details you find on their website. Also, use strong antivirus software to block malicious links and downloads that often follow phishing campaigns. If attackers use this leaked data to target you with infected attachments, antivirus protection adds another layer of defense.

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

Advertisement

6) Monitor your credit reports

If you applied for financing, check your credit reports for unfamiliar inquiries or new accounts. Early detection can help you stop identity theft before it spirals. Consider placing a credit freeze if you see suspicious activity.

7) Consider identity theft protection

Identity theft protection services can monitor for unusual activity tied to your name, Social Security number, or financial accounts. They can alert you quickly if someone tries to open a new credit card in your name.

See my tips and best picks on Best Identity Theft Protection at Cyberguy.com.

Security experts warn the leaked information could be used for phishing scams, fake loan offers and identity theft. (iStock)

Kurt’s key takeaway

This incident highlights a bigger issue than just one company. When platforms collect detailed financial and personal data, they become high-value targets. If the leaked dataset is authentic, millions of people who were simply shopping for a car now face increased risk of scams. CarGurus has not publicly confirmed a breach. Customers deserve clarity when sensitive financial application data may be involved. Silence only increases uncertainty.

Advertisement

Should companies that collect financing data be required to publicly confirm or deny breaches within a set timeframe?  Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report 
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2026 CyberGuy.com. All rights reserved. 

Advertisement

Technology

Trump fires the entire National Science Board

Published

on

Trump fires the entire National Science Board

Multiple sources are reporting that the Trump administration has dismissed the entire National Science Board (NSB). The NSB advises the president and Congress on the National Science Foundation (NSF), which has already been funding research at historically low levels and has seen significant delays in doling out that funding. The NSF has been fundamental in helping develop technology used in MRIs, cellphones, and it even helped get Duolingo get off the ground.

In a statement, Zoe Lofgren, the ranking Democrat on the House Science, Space, and Technology Committee, said:

“This is the latest stupid move made by a president who continues to harm science and American innovation. The NSB is apolitical. It advises the president on the future of NSF. It unfortunately is no surprise a president who has attacked NSF from day one would seek to destroy the board that helps guide the Foundation. Will the president fill the NSB with MAGA loyalists who won’t stand up to him as he hands over our leadership in science to our adversaries? A real bozo the clown move.”

Continue Reading

Technology

How scammers build a profile on you using data brokers

Published

on

How scammers build a profile on you using data brokers

NEWYou can now listen to Fox News articles!

Go to any people finder site right now and type in your name. What comes back might shock you: your age, home address, phone number, the names of your relatives, where you used to live and even what your property is worth.

You didn’t put that there, and you never consented to it. Still, it’s out there, and anyone with an internet connection can see it.

Scammers figured this out a long time ago. Since then, they’ve turned it into a system for targeting you, your parents and your kids.

So how does it actually work, and more importantly, what can you do to stop it?

Advertisement

Sign up for my FREE CyberGuy Report

  • Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
  • For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com, trusted by millions who watch CyberGuy on TV daily.
  • Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

HOW TO REMOVE YOUR PERSONAL INFO FROM PEOPLE SEARCH SITES

A single person search result can reveal your address, relatives and years of personal history in seconds. (Kury “CyberGuy” Knutsson)

How scammers find your personal data online

Before a criminal sends a phishing email or makes a call, they do their homework. Importantly, they don’t need to hack anything. Instead, they use the same public websites that anyone can access.

In less than 10 minutes, a scammer can build a detailed profile on you using data broker sites like Spokeo, Whitepages, BeenVerified and Intelius. Here’s what that profile looks like and how they build it step by step.

Step 1: How scammers search your name on people finder sites

It starts simply. A scammer types your name into a search site. Within seconds, they see results like:

Advertisement

John M. Patterson | Age: 61 | Cleveland, OH

  • Also known as: John Michael Patterson
  • Current address: [your street address]
  • Previous addresses: 4 records found
  • Phone numbers: 2 found
  • Email addresses: 3 found
  • Relatives: 5 found

That is the starting point. Many sites show partial data for free. That is often enough to confirm identity. Full reports cost only a few dollars, so access is easy. Scammers can repeat this process hundreds of times a day, building detailed profiles with very little effort.

Step 2: How scammers map your family and relatives

Next, this is where things get personal. Data broker profiles show more than your name. They reveal your family network.

That often includes:

  • Spouse or partner
  • Children
  • Parents
  • Siblings
  • Roommates

As a result, scammers can target more than one person. For example, they may learn that your elderly parent lives alone or your child just moved. Because of that, scams like the grandparent scam feel real instead of random.

Step 3: How scammers use your address history

At this point, your address history becomes critical. It is not just about where you live. Instead, scammers use it to:

  • Verify identity
  • Find relatives
  • Build trust

For example, referencing a past address makes a caller sound legitimate. That detail alone can lower suspicion.

Step 4: How scammers use your financial data

More importantly, data brokers also reveal financial clues. These may include:

Advertisement
  • Estimated income
  • Home value
  • Ownership status
  • Length of residence

This information comes from public records, not hacking. Because of this, scammers tailor their approach. Higher-income targets may see investment scams

Others may get job or rental scams instead.

GOOGLE SEARCH LED TO A COSTLY SCAM CALL

Scammers use data broker profiles to map your family and build more convincing, targeted attacks. (Kurt “CyberGuy” Knutsson)

Step 5: How scammers verify and cross-check your data

Before launching a scam, criminals often double-check everything. They don’t rely on just one site. Instead, they compare multiple data broker profiles, social media accounts and public records to confirm details are accurate.

For example, they may:

Advertisement
  • Match your address across different sites
  • Check Facebook or LinkedIn to confirm family relationships
  • Look for recent moves, job changes or life events

Because of this, the profile becomes more reliable. That extra step is what turns a guess into something that feels real.

Step 6: How scammers create targeted scams

At that point, they have everything they need. They know your name, family, address and financial details. Now the scam becomes highly specific.

By the time you hear from them, they already know enough to sound like someone you trust.

  • They may call your parent pretending to be you
  • They may bypass bank security questions
  • They may send texts that look like your child
  • They may send emails that reference your life

As a result, the scam feels believable.

Data broker scams are already being prosecuted

This has already landed in court. The U.S. Department of Justice has prosecuted companies like Epsilon, Macromark Inc. and KBM Group for selling data to scammers. Epsilon alone paid $150 million to victims.

At the same time, data tied to the FBI Internet Crime Complaint Center shows more than half of fraud cases involving older Americans were linked to exposed personal data. That shows how serious this problem has become.

Why is your personal data on data broker sites

You do not need to sign up for these sites. Instead, your data comes from many sources, including:

Advertisement
  • Voter records
  • Property records
  • Court filings
  • Social media
  • Marketing surveys
  • Loyalty programs
  • Phone directories
  • Other data brokers

Because of this, your information spreads quickly.

Why your data keeps reappearing online

Even after removal, your data often comes back. Data brokers constantly update their databases. They buy and resell fresh records. Because of that, one-time removal is not enough.

By the time a scam reaches you or your family, it is often built on real data pulled from multiple public sources. (Wei Leng Tay/Bloomberg)

How to disrupt a scammer’s research before they reach your family

The goal isn’t to disappear completely. It’s to make the profile messy enough, incomplete enough and hard enough to find that scammers move on to easier targets.

Here’s what you can do:

  • Search for yourself first. Go to Spokeo, Whitepages, BeenVerified or any other people search site, and look up your own name. See exactly what’s there before a scammer does. That snapshot is your starting point.
  • Submit opt-out requests manually. Every major data broker is required to honor removal requests. The catch: There are hundreds of them, each with its own process, and they relist your information regularly. It’s a full-time job.
  • Use an automated removal service. This is where I strongly recommend a data removal service. Instead of spending hours submitting individual opt-out forms, a data removal service sends removal requests to 420-plus data brokers on your behalf and keeps sending them when your data reappears. Because it will reappear.
  • Set up family alerts. Tell your elderly relatives that you will never ask for money via text from an unknown number. Establish a code word. Scams work because they create panic. A simple family protocol breaks the spell.
  • Change your security questions. If your bank still uses “mother’s maiden name” or “city you were born in” as verification, that information is likely already on a data broker site. Switch to nonsense answers that only you know and store them in a password manager.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

Advertisement

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt’s key takeaways

This kind of scam works because it feels personal. When someone knows your name, your family and even where you used to live, your guard drops. That is exactly what criminals are counting on. 

The uncomfortable truth is that your information is already out there, often in more places than you realize. You do not need to panic, but you do need to be proactive. The more you limit what is easily accessible, the harder it becomes for someone to build a convincing story around you. Start with a simple search of your own name. That one step can completely change how you think about your digital footprint. From there, take action to remove what you can and protect what you cannot.

If a stranger can build a detailed profile on your family in minutes, what does that say about how much of your life is already exposed online? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Advertisement
  • Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
  • For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com trusted by millions who watch CyberGuy on TV daily.
  • Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Copyright 2026 CyberGuy.com.  All rights reserved.

Continue Reading

Technology

The Govee smart lamp brightened up my room, and then my life

Published

on

The Govee smart lamp brightened up my room, and then my life

I knew things were not quite right when I had to throw a towel over a broken Ikea lamp to block out its light. How did I get here? I cover fancy and capable tech for a living, and yet, it took me two years to get rid of a pair of old, broken Ikea lamps in my bedroom. Then I got some floor lamps from Govee that changed everything.

Those Ikea lamps were around for two years after I moved from Orange County to Los Angeles. Soon after that move, my mom’s Parkinson’s disease — a neurodegenerative condition with no cure — progressed quickly, my mental health took a hit, and most of my own to-do list quietly slid to the back burner as she lost mobility and more urgent things took over. So the big, ugly lamps just… stayed. They became part of the background, like everything else I wasn’t taking care of.

I didn’t even have them plugged into a smart plug — another small upgrade I kept meaning to add to my bedroom, despite having them all over the apartment — which meant I had to get up every time I wanted to turn one on.

One blasted harsh, overpoweringly bright light through a cracked shade. The other was warmer — but not warm enough — so I solved that problem one exhausted night by just throwing a towel over it. Yes, a fire hazard. Yes, I meant it as a temporary fix for a few days. But scattered caregiving brain means temporary fixes can turn into long-term solutions. At some point, it stopped feeling temporary and just became my new normal, even if it clearly wasn’t.

Then my brother bought my mom and me two separate Govee Uplighter Floor Lamps for Christmas, and my Ikea lamp troubles were over. I did not expect to develop an emotional attachment to a lamp. But I did, and now it’s one of my favorite gadgets.

Advertisement

The Govee was quick and easy to assemble, and much slimmer, taking up way less space than the old lamps. As I got rid of the old and set up the new, I felt an odd sense of relief and a small sense of control I hadn’t felt since the move.

Within a week, the old lamp was out of my room. That small shift gave me momentum. I started decluttering other corners that had quietly piled up, things I’d been stepping around for months without really seeing anymore.

The bedroom stopped feeling like an unfinished project I was merely surviving, and started feeling steadier. Calmer. Like a place I could finally exhale in. My days often feel structured around what my mom needs and what has to get done next. I don’t really think about my own space at all, except as something else I haven’t gotten to yet. Having a room that felt calm, even a little bit, made it easier to wind down at the end of the day instead of carrying that feeling of being “on” all the time into the night. It brought me back to myself, even if only a little.

I could relax in a way I hadn’t in a while, without feeling like I should be getting up to do something else. I could dim the lamp from my phone instead of standing up. I could shift from cool to warm without needing a towel and risking starting a fire. There’s a ripple effect that slowly moves across the wall and, for reasons I can’t fully explain, genuinely helps me fall asleep. Cycling through soft colors in the app and syncing it with ambient music is soothing. Sometimes, the changing colors feel a little bit like magic, and I find myself watching them the way I might have as a kid, reminded — briefly — that life can be more playful than it’s felt in a while. The warm, shifting light seems to have a similar effect on my mom, who lives with me, sometimes comforting and even dazzling her as she navigates some of the more difficult parts of the disease, like sundowning, along with her own quiet grief of losing pieces of herself.

And I love that it does all that and more without demanding much. Setup took about 15 to 20 minutes and didn’t require that I try to wrap my head around tools. You control it through the Govee app on your phone, and because it supports Matter, you can also pair it with platforms like Amazon Alexa or Google Assistant for voice control. It offers a wide range of colors, along with 80 preset scenes and seven music modes. At $179.99, it’s pricey, but it’s versatile, basically acting as three lights in one: a top section that casts a soft ripple onto the ceiling, a colorful middle light, and a regular white light at the bottom.

It’s an amazing gift, truly, and I am so grateful for it. Mine, however, had just one problem: It sometimes forgets to be a lamp. It doesn’t lose Wi-Fi. It doesn’t show as offline in the app. It just turns off randomly. The first time it happened, I was rewatching Stranger Things to prepare for the last season. The lights flickered on screen, and then my room went dark. The vibe went from relaxing to terrifying in a second, as I briefly wondered if reality and TV had merged (I might have also had too much wine). Once my brain rebooted, I opened the Govee app and turned it back on. No problem. I assumed it was a power or Wi-Fi issue. Govee sent me a new unit that worked perfectly.

Advertisement

When it works — which is most of the time — it quietly makes my life better. And somehow, that’s been enough to make it one of my new favorite gadgets. It didn’t fix everything, but it helped me start taking care of my space — and myself — again.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

Continue Reading
Advertisement

Trending