CarMax

An early-2026 leak of roughly 431,000 email addresses with names, phone numbers and physical addresses was published as data allegedly sourced from CarMax after a failed extortion attempt; CarMax has not publicly confirmed a breach, and whether the data came from CarMax or a vendor is not established. Auto retail data is also unusually complete: a vehicle purchase involves a credit application, income verification, driver's licence, insurance details and often a trade-in history, assembled in a single transaction. Cross-ref the Auto Apps tab and the Allstate/Arity finding in Insurance for what the connected-vehicle layer adds on top.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected. REPORTED (not verified this pass): a separate lawsuit (Feb 2026) has been described as tied to the ShinyHunters campaign that also hit Match Group; no docket or confirmation was located. SEPARATELY, and more significantly: in March 2026, a coalition of SIX CALIFORNIA DISTRICT ATTORNEYS (San Francisco, Santa Clara, Sonoma, Los Angeles, Ventura, Riverside) secured a $1.1 MILLION consumer-protection judgment against CarMax (entered March 24, 2026; announced March 25, 2026) over failures to timely submit DMV title and registration transfers for used cars in thousands of instances since 2019 ($900,000 civil penalties, $150,000 costs, $50,000 restitution; no admission of liability). The DA release does not mention AutoNation; any comparison to the AutoNation-affiliated settlement (see that row) is this tracker's, not the prosecutors'.

Data sharing

REPORTED EARLY-2026 LEAK/EXTORTION CLAIM (not confirmed by CarMax; reported by Botcrawl, Feb 20, 2026): data allegedly sourced from CarMax was published online following a FAILED EXTORTION ATTEMPT — the leaked data included 431,000 unique email addresses along with names, phone numbers, and physical addresses. The 'failed extortion' framing suggests CarMax may have declined to pay a ransom demand, after which the attacker published the data publicly (a similar pattern to the Panera Bread ShinyHunters incident documented elsewhere in this tracker).

Contacts

Privacy contact. Not recorded.

Legal notice. PUBLIC COMPANY (KMX). Service route: c/o General Counsel / Corporate Secretary, Richmond, Virginia — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.

Mailing address. Not recorded.