Breach occurred 2026-01-24Verified

CarMax data breach

carmax.com

What happened

In January 2026, data allegedly sourced from US automotive retailer CarMax was published online following a failed extortion attempt. The data included 431k unique email addresses along with names, phone numbers and physical addresses.

431,371 accounts affected

Breach date 2026-01-24

Data exposed

Email addressesNamesPhone numbersPhysical addresses

Frequently asked questions

When did the CarMax data breach happen?

The CarMax data breach occurred on January 24, 2026. It was added to Have I Been Pwned's breach catalog on February 20, 2026.

How many accounts were affected by the CarMax breach?

431,371 accounts were affected by the CarMax data breach, according to Have I Been Pwned's records.

What data was exposed in the CarMax breach?

The CarMax breach exposed the following data types: Email addresses, Names, Phone numbers, Physical addresses.

Is the CarMax breach verified?

Yes. Have I Been Pwned has verified the CarMax breach, meaning there's confirmed evidence the exposed data is genuine and tied to real accounts.

How do I check if my email was affected by the CarMax breach?

Use KazaSec's free Email Breach Checker (/tools/breach-check) to check whether a specific email address has surfaced in the CarMax breach, or any other known breach — the tool never stores what you search.

Was your own email in this breach?

Our free Email Breach Checker tells you whether a specific email address has surfaced in this breach — or any other known breach — without ever storing what you search.

Check your email →

Talk to us about this

Security Consulting

Understand what a breach like this would actually cost you, and how to reduce that risk.

Penetration Testing

Find the same class of gap before it leads to a breach like this one.

View on Have I Been Pwned

Don't want to end up on this list?

We help organizations find and fix the gaps that lead to a breach, before they do.

Request a Security Assessment Browse Services