Skip to content
Data breachResolved

CarMax data breach (2026)

In January 2026, data allegedly sourced from US automotive retailer CarMax was published online following a failed extortion attempt. The data included 431k unique email addresses along with names, phone numbers and physical addresses.

Victim
CarMax
records
431.4K
SectorRetail

Imported from Have I Been Pwned — pending editorial review and translation to French. The summary below is machine-extracted; consult the source for details.

In 2026-01-24, CarMax was affected by a data breach. Approximately 431,371 accounts were exposed. In January 2026, data allegedly sourced from US automotive retailer CarMax was published online following a failed extortion attempt. The data included 431k unique email addresses along with names, phone numbers and physical addresses.

Sources

  1. haveibeenpwned.comhttps://haveibeenpwned.com/PwnedWebsites#CarMax
  2. carmax.comhttps://carmax.com

Related incidents