Edmunds data breach
177,860 accounts exposed in a breach on 24 January 2026. Passwords were included.
At a glance
177,860
Accounts exposed
24 January 2026
Date of the breach
1 June 2026
Added to the list
What happened
In January 2026, the automotive research and car-shopping platform Edmunds was listed by the ShinyHunters hacking group as having been breached. Data purportedly obtained in the incident was later published publicly and included 178k unique email addresses, usernames, passwords, IP addresses, phone numbers and vehicle-related records.
What was exposed
- Device information. Details of your devices were exposed. They show what you use but cannot be used to log in.
- Email addresses. Email addresses were exposed. Expect more spam and phishing aimed at those addresses.
- IP addresses. Internet addresses were exposed. They show roughly where and how you connect. They cannot be used to log in.
- Passwords. Passwords were exposed. Anyone who holds them can try them on other accounts, so treat any account that used the same password as at risk.
- Phone numbers. Phone numbers were exposed. Expect scam calls and text messages, some of them pretending to be the organisation.
- Usernames. Usernames were exposed. Together with a reused password they open accounts.
What to do now
It depends on what was exposed, so these steps follow the list above.
If your password or sign-in details were exposed
- Change the password on the affected account now, and on every other account that used the same password.
- Use a password manager so each account has its own long, random password.
- Turn on two-step sign-in (multi-factor authentication) wherever it is offered, so a stolen password alone is not enough.
- If security questions were exposed, change them too, and treat the answers like passwords.
If your contact details were exposed
- Expect more spam, scam calls and phishing. Do not click links or open attachments in messages you did not expect.
- If a message mentions this breach, do not reply. Go to the organisation's own website or app instead of using a link in the message.
Whatever was exposed
- Check which other breaches include your own email address and phone number.
- Keep an eye on your accounts for a few months. Breached data is often used long after the breach.
- If you think someone is using your details, report it to the organisation and to your national cyber crime reporting service.
Check your own exposure
- Password leak check: find out whether a password has appeared in a breach. The password never leaves your browser.
- Free domain security scan: grade the email, DNS and website security of a domain you own.
Related breaches
Other breaches that exposed some of the same kinds of data.
Paidwork
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale.
- Bank account numbers
- Dates of birth
- Device information
- Education levels
- +10 more
Read what happened
University of Nottingham
In June 2026, the University of Nottingham was the target of a cyber attack, later linked to a ShinyHunters "pay or leak" extortion campaign.
- Academic records
- Citizenship statuses
- Dates of birth
- Disabilities
- +11 more
Read what happened
Atlas Menu
In May 2026, the GTA V and CS2 cheat service Atlas Menu suffered a data breach. An attacker claimed to have gained access to all Atlas systems and published the…
- Email addresses
- IP addresses
- Passwords
- Support tickets
- +1 more
Read what happened