CarMax data breach
431,371 accounts exposed.
Check whether your email is included on Have I Been Pwned.
What was exposed
Email addressesNamesPhone numbersPhysical addresses
What to do
- Expect more phishing emails that mention this service. Do not click links in them; go to the site directly.
- Be wary of texts and calls that seem to know your details.
- Turn on two-step verification wherever it is offered, and use a password manager.
About this breach
In January 2026, data allegedly sourced from US automotive retailer CarMax was published online following a failed extortion attempt. The data included 431k unique email addresses along with names, phone numbers and physical addresses.