Betterment and CarGurus Data Breach Claims Involving Stolen Customer and Corporate Records
Fintech platform Betterment reported a January 2026 social-engineering incident in which an employee was tricked into providing credentials that enabled unauthorized access to internal messaging systems via third-party tools. Betterment said it detected and contained the access the same day, launched an external forensic investigation, and later indicated the incident affected roughly 1.4 million customers; exposed data included names, email addresses, and location data broadly, with a smaller subset including phone numbers, physical addresses, dates of birth, job titles, and device details. Betterment stated that no financial accounts, logins, or passwords were accessed, but warned that the stolen PII was used to send crypto-scam messages impersonating Betterment to pressure users into transferring funds.
Separately, the extortion group ShinyHunters claimed it stole 1.7 million CarGurus corporate records and threatened to leak the data if the company did not engage by a stated deadline; the criminals alleged the haul included PII and internal corporate data, and CarGurus had not publicly confirmed the claim at the time of reporting. The same reporting tied the CarGurus claim to a broader run of ShinyHunters-related leak-site postings and extortion threats against other organizations, with at least one victim (Canada Goose) indicating that data recently published online may have been historical rather than from a new intrusion.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
7 events from the most recent confirmed update back to the earliest known activity.
ShinyHunters sets CarGurus extortion deadline
The group threatened to leak the allegedly stolen CarGurus data unless the company engaged by 2026-02-20. This marked the extortion phase of the claimed CarGurus breach.
Betterment discloses 1.4 million customers affected
Betterment reported that about 1.4 million customers were impacted, with exposed data including names, email addresses, and locations, and additional PII for a smaller subset. The disclosure was reported publicly in February 2026.
ShinyHunters claims breach of CarGurus and theft of 1.7M records
On 2026-02-18, ShinyHunters claimed it had breached CarGurus and stolen 1.7 million corporate records, including personally identifiable information and internal company data. CarGurus did not immediately respond to media inquiries.
ShinyHunters lists Figure Technology Solutions on leak site
Figure Technology Solutions was named on ShinyHunters' leak site, and the company said the incident began after an employee was socially engineered. Figure said it blocked the activity, hired a forensic firm, and offered credit monitoring.
Attackers send Betterment-branded crypto scam messages
Using the compromised Betterment access, the attackers sent fraudulent Betterment-branded notifications urging users to transfer funds to attacker-controlled cryptocurrency wallets. Betterment warned customers to ignore the scam messages and to monitor for suspicious activity and use MFA.
Betterment detects intrusion and revokes access
On 2026-01-09, Betterment detected the unauthorized access, revoked the compromised permissions the same day, and began an external forensic investigation. The company later said no financial accounts, logins, or passwords were accessed.
Betterment employee socially engineered in January 2026 breach
In January 2026, attackers tricked a Betterment employee into providing credentials, enabling unauthorized access to internal messaging systems through third-party tools. The intrusion was described as social-engineering-driven and later linked in reporting to ShinyHunters' broader activity.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
Betterment Suffers a Data Breach - TheCyberThrone
thecyberthrone.in
Open sourceShinyHunters allegedly drove off with 1.7M CarGurus records • The Register
go.theregister.com
Open sourceSecurity Incident Report: January 2026 - Betterment - Infosec.Pub
infosec.pub
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CarGurus Customer Data Leak Attributed to ShinyHunters
**CarGurus** customer data was published online in a leak attributed to the **ShinyHunters** extortion group, exposing roughly **12.4–12.5 million** accounts. A **6.1GB** archive was posted and subsequently ingested by *Have I Been Pwned* (HIBP) after validation checks; HIBP reported the dataset includes **email addresses, IP addresses, full names, phone numbers, physical addresses, user account IDs**, and additional sensitive business/transactional fields such as **finance pre-qualification application data, finance application outcomes, dealer account details, subscription information**, and account ID mappings. HIBP indicated about **70%** of the data had appeared in prior breaches already tracked by the service, implying roughly **3.7 million** records may be newly exposed; the public availability of the dataset increases risk of **targeted phishing and fraud** using the enriched identity and financing-related attributes. CarGurus had not publicly confirmed the incident at the time of reporting and did not respond to media requests, while HIBP and reporting attributed the breach to ShinyHunters, a group known for **social engineering/vishing-style** intrusions and subsequent extortion/leak tactics. Separate ShinyHunters-linked incidents reported in the same period included **Wynn Resorts** confirming theft of employee data following an extortion threat, and **Optimizely** disclosing a breach tied to a **voice-phishing** attack that exposed limited business contact information; these are distinct events and do not change the core CarGurus exposure but reinforce the group’s ongoing operational tempo and reliance on social engineering to obtain access and data for leverage.
Mar 27, 2026
ShinyHunters-Linked Extortion and Data Leak Claims Targeting Automotive Retailers
Data allegedly sourced from US automotive retailer **CarMax** was published online after a **failed extortion attempt**, according to a Have I Been Pwned breach entry. The exposed dataset reportedly includes **431,000 unique email addresses** along with **names, phone numbers, and physical addresses**, indicating a PII-heavy leak that could enable targeted phishing and identity-focused fraud. Separately, **CarGurus** was reported as being purportedly breached by the **ShinyHunters** hacking operation, with claims of **1.7 million corporate files** stolen and an extortion deadline tied to negotiations. The intrusion was alleged to have occurred via **single sign-on (SSO) codes obtained through voice phishing**, consistent with ShinyHunters’ prior claims of compromising other organizations using SSO-code access; CarGurus has been positioned as another extortion-driven theft where internal records and PII may be at risk of exposure.
Mar 21, 2026
ShinyHunters Data-Theft and Extortion Targeting CarGurus and Wynn Resorts
**ShinyHunters** is linked to multiple large-scale data-theft and extortion operations, including a breach at automotive marketplace **CarGurus** in February 2026. After an attempted extortion, the stolen CarGurus data was published publicly and reportedly included **12M+ email addresses** across multiple files, with additional exposed information such as names, phone numbers, physical and IP addresses, user account ID mappings, dealer account/subscription details, and auto finance pre-qualification application data (including application outcomes). ShinyHunters also claimed to have stolen **800,000+ records** from **Wynn Resorts** and demanded **22.34 Bitcoin (~$1.5M)** to prevent publication, setting a deadline and threatening further “digital problems” if unpaid. Data samples reviewed by a media outlet reportedly contained employee PII including **Social Security numbers**, names, emails, phone numbers, job details, salaries, start dates, and birthdays; the group alleged initial access occurred in **September 2025** via an **Oracle PeopleSoft vulnerability** combined with an employee’s credentials, and it did not clarify whether the credentials were obtained through social engineering or insider access-for-hire.
Mar 21, 2026