Possibly, through their people. The February 2026 CarGurus breach exposed data tied to about 12.5 million accounts, and Have I Been Pwned reports it included dealer account and subscription information. CarGurus said it saw no indication that dealer data feeds, APIs or core systems were compromised.
What was exposed
According to Have I Been Pwned, the published data included email addresses, names, phone numbers, physical addresses, IP addresses, account ID mappings, finance pre-qualification application data, and dealer account and subscription information. Passwords are not listed among the exposed data types. HIBP also noted that roughly 70% of the email addresses had already appeared in earlier breaches.
What we found at one dealer group
Earlier this year, Digital Risk Inc. (DRI) assessed five people at one dealer group. Two of them had email addresses in the CarGurus dataset, and one of those was a work address. That is one group, not a statistic, but it shows how a vendor’s breach becomes your staff’s exposure.
Why an exposed work email matters
An exposed work email does not mean a system was breached. It does give attackers a confirmed address and context for a convincing phishing message, for example one that references a dealer account or subscription.
What dealers can do
- Check staff work emails on Have I Been Pwned, or ask a provider to check them for you.
- Turn on multi-factor authentication for email and dealer platform logins.
- Warn staff about messages that reference CarGurus accounts, subscriptions or billing.
- Reset any password that was reused on a CarGurus account.
Sources
- Have I Been Pwned, CarGurus breach
- TechCrunch, CarGurus data breach affects 12.5 million accounts
- SecurityWeek, CarGurus breach impacts over 12 million users
Digital Risk Inc. (DRI) measures human cyber exposure for dealerships and small businesses: breached credentials, exposed personal data and impersonation risk tied to the people on your team. See how it works for dealerships.