ShinyHunters Data-Theft and Extortion Targeting CarGurus and Wynn Resorts
ShinyHunters is linked to multiple large-scale data-theft and extortion operations, including a breach at automotive marketplace CarGurus in February 2026. After an attempted extortion, the stolen CarGurus data was published publicly and reportedly included 12M+ email addresses across multiple files, with additional exposed information such as names, phone numbers, physical and IP addresses, user account ID mappings, dealer account/subscription details, and auto finance pre-qualification application data (including application outcomes).
ShinyHunters also claimed to have stolen 800,000+ records from Wynn Resorts and demanded 22.34 Bitcoin (~$1.5M) to prevent publication, setting a deadline and threatening further “digital problems” if unpaid. Data samples reviewed by a media outlet reportedly contained employee PII including Social Security numbers, names, emails, phone numbers, job details, salaries, start dates, and birthdays; the group alleged initial access occurred in September 2025 via an Oracle PeopleSoft vulnerability combined with an employee’s credentials, and it did not clarify whether the credentials were obtained through social engineering or insider access-for-hire.
Timeline
Feb 23, 2026
ShinyHunters sets Wynn Resorts ransom and leak deadline
ShinyHunters demanded that Wynn Resorts make contact by February 23, 2026, threatening to leak the stolen data and cause additional digital disruption if its demands were not met. The group also advertised a starting sale price of 22.34 bitcoin, about $1.5 million, for the data.
Feb 20, 2026
ShinyHunters lists Wynn Resorts on extortion site
By February 20, 2026, Wynn Resorts appeared on ShinyHunters' extortion site, where the group claimed it had stolen more than 800,000 employee records containing Social Security numbers, salary data, contact details, and other sensitive personal information. The Register reviewed sample data allegedly tied to the breach.
Feb 1, 2026
ShinyHunters attempts to extort CarGurus and later releases stolen data
After the CarGurus intrusion, ShinyHunters attempted to extort the company. When the extortion attempt failed, the stolen data was publicly released.
Feb 1, 2026
CarGurus suffers data breach attributed to ShinyHunters
In February 2026, automotive marketplace CarGurus experienced a data breach attributed to ShinyHunters. The stolen data reportedly included more than 12 million email addresses along with finance application, dealer account, subscription, and other personal and account-related information.
Sep 1, 2025
ShinyHunters allegedly gains access to Wynn Resorts via Oracle PeopleSoft
A ShinyHunters spokesperson claimed the group obtained initial access to Wynn Resorts in September 2025 through an Oracle PeopleSoft vulnerability using an employee's credentials. The report did not clarify whether the credentials were acquired through social engineering or purchased from an insider.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Threat Actors
Organizations
Affected Products
Sources
Related Stories
CarGurus Customer Data Leak Attributed to ShinyHunters
**CarGurus** customer data was published online in a leak attributed to the **ShinyHunters** extortion group, exposing roughly **12.4–12.5 million** accounts. A **6.1GB** archive was posted and subsequently ingested by *Have I Been Pwned* (HIBP) after validation checks; HIBP reported the dataset includes **email addresses, IP addresses, full names, phone numbers, physical addresses, user account IDs**, and additional sensitive business/transactional fields such as **finance pre-qualification application data, finance application outcomes, dealer account details, subscription information**, and account ID mappings. HIBP indicated about **70%** of the data had appeared in prior breaches already tracked by the service, implying roughly **3.7 million** records may be newly exposed; the public availability of the dataset increases risk of **targeted phishing and fraud** using the enriched identity and financing-related attributes. CarGurus had not publicly confirmed the incident at the time of reporting and did not respond to media requests, while HIBP and reporting attributed the breach to ShinyHunters, a group known for **social engineering/vishing-style** intrusions and subsequent extortion/leak tactics. Separate ShinyHunters-linked incidents reported in the same period included **Wynn Resorts** confirming theft of employee data following an extortion threat, and **Optimizely** disclosing a breach tied to a **voice-phishing** attack that exposed limited business contact information; these are distinct events and do not change the core CarGurus exposure but reinforce the group’s ongoing operational tempo and reliance on social engineering to obtain access and data for leverage.
1 months ago
ShinyHunters-Linked Extortion and Data Leak Claims Targeting Automotive Retailers
Data allegedly sourced from US automotive retailer **CarMax** was published online after a **failed extortion attempt**, according to a Have I Been Pwned breach entry. The exposed dataset reportedly includes **431,000 unique email addresses** along with **names, phone numbers, and physical addresses**, indicating a PII-heavy leak that could enable targeted phishing and identity-focused fraud. Separately, **CarGurus** was reported as being purportedly breached by the **ShinyHunters** hacking operation, with claims of **1.7 million corporate files** stolen and an extortion deadline tied to negotiations. The intrusion was alleged to have occurred via **single sign-on (SSO) codes obtained through voice phishing**, consistent with ShinyHunters’ prior claims of compromising other organizations using SSO-code access; CarGurus has been positioned as another extortion-driven theft where internal records and PII may be at risk of exposure.
1 months ago
Betterment and CarGurus Data Breach Claims Involving Stolen Customer and Corporate Records
Fintech platform **Betterment** reported a January 2026 social-engineering incident in which an employee was tricked into providing credentials that enabled unauthorized access to internal messaging systems via third-party tools. Betterment said it detected and contained the access the same day, launched an external forensic investigation, and later indicated the incident affected roughly **1.4 million customers**; exposed data included names, email addresses, and location data broadly, with a smaller subset including phone numbers, physical addresses, dates of birth, job titles, and device details. Betterment stated that **no financial accounts, logins, or passwords** were accessed, but warned that the stolen PII was used to send **crypto-scam messages** impersonating Betterment to pressure users into transferring funds. Separately, the extortion group **ShinyHunters** claimed it stole **1.7 million CarGurus corporate records** and threatened to leak the data if the company did not engage by a stated deadline; the criminals alleged the haul included PII and internal corporate data, and CarGurus had not publicly confirmed the claim at the time of reporting. The same reporting tied the CarGurus claim to a broader run of ShinyHunters-related leak-site postings and extortion threats against other organizations, with at least one victim (Canada Goose) indicating that data recently published online may have been **historical** rather than from a new intrusion.
1 months ago