""This is a final warning to reach out by 20 Feb 2026 before we leak along with several annoying (digital) problems that'll come your way," ShinyHunters wrote in its announcement, seen by The Register and shared on social media. The digital crooks claimed the compromised files included personally identifiable information and "other internal corporate data." CarGurus did not immediately respond to The Register's inquiries. We will update this story when we hear back from the company."
"The Wednesday posts cap a string of 15 breaches claimed by ShinyHunters and Scattered Lapsus$ Hunters since the beginning of the year, including penetrating two investment advisory firms, Mercer Advisors and Beacon Pointe Advisors, listed on Sunday. The extortionists set a Wednesday deadline for both companies to negotiate and threatened to leak 5 million records from Mercer and 100,000 from Beacon Pointe. Neither firm has posted a breach notification, and they did not respond to The Register's requests for comment."
"On Monday, Canada Goose told us that it was "aware that a historical dataset relating to past customer transactions has recently been published online." The down-filled jacket purveyor, however, declined to say how old the data is or how it was originally stolen. Blockchain lending firm Figure Technology Solutions was also listed on ShinyHunters' leak site last week, and according to Have I Been Pwned, the criminals stole nearly 1 million customers' records."
ShinyHunters claims to have stolen 1.7 million corporate records from CarGurus and posted the company's data on its leak site, demanding contact by 20 Feb 2026 and warning of further digital disruptions. The alleged files reportedly include personally identifiable information and other internal corporate data. CarGurus did not immediately respond to inquiries. The postings follow a pattern of claimed breaches by ShinyHunters and Scattered Lapsus$ Hunters, including alleged compromises of Mercer Advisors, Beacon Pointe Advisors, Figure Technology Solutions, and others, with threats to publish millions of records. Canada Goose acknowledged a historical dataset of past customer transactions was published online.
Read at Theregister
Unable to calculate read time
Collection
[
|
...
]