CarMax — data breach (CarMax)

Domain: carmax.com · Accounts affected: 431,371 · Data exposed: Email addresses, Names, Phone numbers, Physical addresses · Verified breach — In January 2026, data allegedly sourced from US automotive retailer CarMax was published online following a failed extortion attempt. The data included 431k unique email addresses along with names, phone numbers and physical addresses.