Have you had your personal data leaked by CarGurus?
KP Law are investigating a substantial data breach by automotive retailer CarGurus. It is believed that over 12 million account holders could be affected.
If you believe you may have been affected by this serious cyber incident then let KP Law know today.
In February 2026 CarGurus was reportedly infiltrated by the cybercrime group ShinyHunters. While the group initially claimed to have accessed 1.7 million customer records, cyber experts have suggested that the stolen data may in fact contain the personal data of over 12 million customers. Data accessed illegally could include details such as names, home addresses, email addresses, phone numbers and information linked to finance pre-qualification applications.
KP Law is building a claim against CarGurus. This is a severe breach and we understand the potential impact on those affected. We believe you deserve justice. If you had/have an account with CarGurus, you may qualify to join our claim.
“Data breach claims play an important role in holding organisations accountable when personal information is not adequately protected. Our team combines data protection expertise with experience of complex group actions to investigate breaches and pursue appropriate remedies.”
Kingsley Hayes | Partner & Head of Data & Privacy Litigation
While each case is judged on its own merits, there are some things we would typically look for when it comes to when claiming compensation following a data breach, cybercrime or other GDPR violation:
With stolen data, cybercriminals can make purchases using your bank and credit cards, apply for credit in your name, set up fraudulent bank accounts and access your existing online accounts.
GDPR failures, cybercrime and data breaches can have a significant impact on you, both mentally and physically. They can cause or exacerbate anxiety, stress and other psychological conditions.
Your data has value, and organisations must be held to account if they fail to protect your right to data privacy or otherwise do not uphold your GDPR rights.
Our team at KP Law has a strong track record of holding large corporations accountable for data misuse and privacy breaches. We operate on a no-win, no-fee basis, so there’s no cost to you unless your claim is successful.
KP Law is one of the leading law firms in England & Wales, specialising in what is often referred to as group action litigation. We champion the rights of individuals, acting as someone on your side to help hold businesses to account when they let you down.
Click the link below to our sign-up form which will take around 15 minutes to complete. We’ll keep your information secure, and we’ll keep you updated as the case progresses.
If you believe your data may have been accessed, you should follow the below steps to protect yourself from further harm:
Change your login details for CarGurus, and ensure your other accounts use strong, unique passwords. Customers were also advised to change passwords and enable two-factor authentication (2FA) at the same time as a precautionary measure.
Stay alert for suspicious calls, texts or emails. Whilst the breach included limited betting account information and recent activity on accounts, there’s still a risk that even limited personal information could be used in phishing scams.
Be aware of any unexpected activity on your accounts – consider getting a copy if your credit file to check for identity misuse after the breach
At KP Law, we represent clients in group actions with the innovation, resources and expertise needed to take on complex cases. Our GDPR, data breach and cybercrime specialists have more than 50 years of combined experience, making us one of the most experienced multi-claimant law firms in the UK. Working alongside leading barristers and legal experts, we provide the highest standard of support while leveraging the resources and global expertise required to pursue challenging claims successfully. With offices in London, Liverpool, Manchester and Birmingham, supported by technology that enables us to serve clients across England and Wales, we combine national reach with a modern, client-focused approach. By using innovative technology, operating on a no-win, no-fee basis, and keeping the process straightforward and hassle-free, we make accessing expert legal representation as simple as possible.
CarGurus is an automotive shopping website headquartered in the USA that compares local dealerships on behalf of consumers.
In February 2026, a cybercriminal group known as ShinyHunters claim to have accessed Cargurus internal systems, likely through a method known as “vishing”, or voice phishing where the criminal calls an employee of a company posing as a member of the IT team. They will ask the employee for passwords or other sensitive information that can help them gain access to wider company systems.
After the ShinyHunters group gained access to Cargurus systems, they accessed 1.7 million private company records, and threatened to release the data publicly unless a ransom was paid.
Sometime later, a 6.1GB archive was leaked on the dark web, containing up to 12 million email addresses of Cargurus customers.
CarGurus posted the following information on their website for affected customers here.
Your dealership should have contacted you if your data was accessed. If you haven’t received a notification, but you are worried that your data has been leaked, sign up using our link, and we will investigate on your behalf.
Anyone who thinks they might be involved should take immediate steps to protect themselves. Find out how to do this here.
If you believe that you may have been affected by the CarGurus data breach, register to receive updates on our investigation. We’ll let you know what’s happening, and if and when you can make a data breach compensation claim.
A group action claim is where a group of people – sometimes even thousands of people – have been affected by the same issue. Group action cases are also known as class actions, multi-claimant, or multi-party actions.
If we do launch a group action, there are no costs to join a claim. However, if your claim is successful, you may have to pay a ‘success fee’. This fee is taken from the compensation awarded to you. At KP Law, our success fee is competitive, and we make sure you are fully informed about any potential costs before you officially join our action. If you lose, you won’t have to pay a penny.
If your dealership was affected by the data breach, you may be able to join our claim. Please fill out the registration form and one of our team will be in touch with further information.
“Used KP Law for a group data breach compensation claim. I was kept updated throughout the process. The whole thing was easy with no stress.” – Anon
“I used the firm as part of a group action following a, potentially, hazardous data breach. From the very start, I was kept updated regarding the other side’s actions and what the counter actions were. I found KP to be trustworthy, knowledgeable and very customer friendly.” – Pat
“I used KP Law for the first time for a data breach group compensation claim. From outset to conclusion I was kept fully informed and received clear, regular updates throughout. I would not hesitate to recommend them and would choose them in any future action.” – Owen
By not putting adequate processes and training in place, organisations are leaving customers open to an increased risk of cyber scams and avoidable mistakes that lead to data breaches. If you are a victim of a data protection failure, check out our current group actions below to see if we are running a claim related to that specific breach.
Unsure if your personal data has been exposed in a breach? Learn how to check and what steps to take, including your right to join a group claim in the UK.
At KP Law, our expert data breach lawyers want to lessen the impact of a data violation as much as possible. To help, we have collated a range of support, information and other resources to help you get your life back on track.
The Court of Appeal has handed down its judgment in Farley v Paymaster, a landmark decision which strengthens the rights of data breach victims
In today’s digital world, personal data has become one of the most valuable commodities—especially for cybercriminals. From financial details to personal information and even login credentials, hackers actively seek out this information to commit fraud, identity theft, and other illegal activities. Stolen data is bought and sold on the dark
In today’s digital landscape, safeguarding personal information is more critical than ever. A data breach occurs when unauthorised individuals gain access to confidential data, leading to potential misuse of sensitive information. This can result in identity theft, financial loss, and a breach of privacy. What is a Data Breach? A
