optimizely

More than 12 million users have been affected by a data breach at automotive research and shopping website CarGurus. The incident was disclosed last week, when the infamous extortion group ShinyHunters added CarGurus to its Tor-based leak site, claiming the theft of personally identifiable information (PII) and internal corporate data. Initially, the hackers said they stole 1.7 million records from the company, but have since leaked a 6.1GB archive that contains information pertaining to approximately 12.5 million accounts. The compromised information, data breach notification website Have I Been Pwned says, includes names, addresses, email addresses, phone numbers, and IP addresses. “Following an attempted extortion, the data was published publicly and contained more than 12M email addresses across multiple files, including user account ID mappings, finance pre-qualification application data, and dealer account and subscription information,” the breach notification service says. In a post on X, Have I Been Pwned noted that roughly 70% of the email addresses in the data set have been compromised in other data breaches as well and were already in its database. CarGurus has yet to acknowledge the incident publicly. SecurityWeek has emailed CarGurus for a statement about the ShinyHunters’ claims and will update this article if the company responds. While it is unclear how the data was stolen, ShinyHunters is known for mounting sophisticated voice phishing (vishing) attacks that have compromised numerous organizations. More than 100 organizations were targeted in a recent ShinyHunters phishing campaign, with some of the latest incidents attributed to the hacking group impacting Optimizely, Figure, Panera Bread, and Crunchbase. Related: Dior, Louis Vuitton, Tiffany Fined $25 Million in South Korea After Data Breaches Related: ApolloMD Data Breach Impacts 626,000 Individuals Related: Under Armour Looking Into Data Breach Affecting Customers’ Email Addresses Related: 750,000 Impacted by Data Breach at Canadian Investment Watchdog

Las Vegas-based high-end casino and hotel operator Wynn Resorts has confirmed that hackers have stolen employee data. “We have learned that an unauthorized third party acquired certain employee data,” the company told SecurityWeek. “Upon discovery, we immediately activated our incident response protocols and launched a thorough investigation with the help of external cybersecurity experts.” “This incident has had no impact on our guest experience, our operations or our physical properties, which are all fully operational and open for business,” it added. Wynn Resorts was added to the ShinyHunters data leak website on February 20, when the hackers claimed to have stolen more than 800,000 records containing personally identifiable information (including SSNs) and employee data. “This is a final warning to reach out by 24 Feb 2026 before we leak along with several annoying (digital) problems that’ll come your way. Make the right decision, don’t be the next headline,” the hackers said in a message addressed to Wynn Resorts at the time. Wynn Resorts has since been removed from the ShinyHunters website and the company’s statement suggests a ransom may have been paid. “The unauthorized third party has stated that the stolen data has been deleted,” the company said in an emailed statement. “We are monitoring and to date have not seen any evidence that the data has been published or otherwise misused.” SecurityWeek has asked Wynn for confirmation that a ransom has indeed been paid, but the company declined to comment. The Register previously reported that the cybercrime group had demanded a ransom of 22.34 bitcoin (roughly $1.5 million). The luxury hospitality and gaming company said its investigation is ongoing, but it has decided to offer credit monitoring and identity protection services to affected employees. “The security and confidentiality of our employees, as well as our guest data, is our top priority,” Wynn said. “While no company can ever eliminate the risk of a cyberattack, we are taking appropriate steps and working with industry-leading third-party IT advisors to strengthen our systems to protect against future incidents.” The ShinyHunters group is believed to have targeted more than 100 organizations in recent campaigns, which often involve vishing and compromised SSO credentials. The cybercriminals have named several major companies on their leak site in recent weeks, including Figure, Betterment, Crunchbase, SoundCloud, and Panera Bread. Related: Ad Tech Company Optimizely Targeted in Cyberattack Related: Ransomware Groups May Pivot Back to Encryption as Data Theft Tactics Falter

Ad tech firm Optimizely has confirmed that threat actors accessed certain internal business systems through a sophisticated voice phishing (vishing) attack. The incident, the company told SecurityWeek, was immediately contained, the affected systems were secured, and the unauthorized access was terminated. “The threat actor gained access to Optimizely’s systems through a sophisticated voice-phishing attack, but was unable to escalate privileges, install software, or create any backdoors in the Optimizely environment,” the company said. Optimizely says it has no evidence of any sensitive customer data or personal information being compromised in the attack, but has proactively notified its customers of the incident. The company said the incident did not disrupt its operations and confirmed that the attackers were able to access business contact information. “The incident was confined to certain internal business systems including Zendesk, records in our Salesforce CRM, and a limited set of internal documents used for back-office operations,” the company said. Optimizely has notified law enforcement of the attack and has engaged third-party cybersecurity experts and legal counsel to aid with the investigation. “We are prioritizing transparency with our customers and partners; we have informed them of the incident and its scope and are continuing to provide updates and individual guidance to them directly,” the ad tech firm told SecurityWeek. Optimizely did not name the threat actor behind the attack, but its description of the incident suggests that the infamous ShinyHunters extortion group might have been responsible for it. Based in New York, Optimizely provides a digital experience platform enabling organizations to improve their websites and digital content. It operates 21 offices worldwide, has nearly 1,500 employees, and provides services to more than 10,000 businesses, including H&M, PayPal, Toyota, Vodafone, and Zoom. Related: US Healthcare Diagnostic Firm Says 140,000 Affected by Data Breach Related: PayPal Data Breach Led to Fraudulent Transactions Related: Nearly 1 Million User Records Compromised in Figure Data Breach Related: Dutch Carrier Odido Discloses Data Breach Impacting 6 Million

The ShinyHunters extortion group has published personal information in more than 12 million records allegedly stolen from CarGurus, a U.S.-based digital auto platform. CarGurus is a publicly traded automotive research and shopping company that operates in the U.S., Canada, and the U.K. Its website has an estimated 40 million monthly visitors and helps people find, compare, and contact sellers of new and used vehicles. On February 21, the threat group published a 6.1GB archive containing 12.4 million records, saying it was from CarGurus. A day later, the HaveIBeenPwned (HIBP) data breach monitoring and alerting platform added the dataset, listing the following data types as compromised: Email addresses IP addresses Full names Phone numbers Physical addresses User account IDs Finance pre-qualification application data Finance application outcomes Dealer account details Subscription information Although CarGurus has not released an official statement disclosing a data breach and did not respond to BleepingComputer's request for comment, it is important to note that HIBP attempts to confirm the validity/authenticity of the leaked records before adding them. HIBP reports that 70% of the leaked data was already on its database from previous incidents, so roughly 3.7 million records are fresh. Since the information is freely available for download, cybercriminals could take advantage of it for phishing attacks. CarGurus users are advised to stay alert for potentially malicious communications and scam attempts leveraging the leaked information. The ShinyHunters data extortion group has been very active recently, claiming multiple attacks on large companies and leaking their data when negotiations reached a dead end. The most recent examples include Dutch telecommunications provider Odido, ad tech firm Optimizely, fintech firm Figure, outerwear brand Canada Goose, restaurant chain Panera Bread, online dating company Match Group, and music streaming platform SoundCloud. The threat group typically uses social engineering, most commonly voice phishing, to breach organizations, directing victims to credential-harvesting pages that grant them access to SaaS platforms such as Salesforce, Okta, and Microsoft 365. Previous ShinyHunters campaigns also involved tricking employees into installing malicious OAuth applications that granted them API-level read access to customer data tables inside Salesforce instances. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

New York-based ad tech company Optimizely has notified an undisclosed number of customers of a data breach after threat actors compromised some of its systems in a voice phishing attack. Optimizely has nearly 1,500 employees across 21 global offices, and its customer list includes over 10,000 businesses, including high-profile brands like H&M, PayPal, Zoom, Toyota, Vodafone, Shell, Salesforce, and Nike. In breach notification letters sent to affected customers, the company, the threat actors reached out on February 11, claiming they had access to its systems. Optimizely also told BleepingComputer that the attackers breached some of its systems and stole what it described as "basic business contact information." "The threat actor gained access to Optimizely's systems through a sophisticated voice-phishing attack, but was unable to escalate privileges, install software, or create any backdoors in the Optimizely environment, and we have no evidence that the threat actor was able to access sensitive customer data or personal information beyond basic business contact information," it said. Optimizely also noted the "incident was confined to certain internal business systems, records in our CRM, and a limited set of internal documents used for back-office operations," and added that its "business operations continue without disruption." The company also warned customers to be wary of attacks that could use some of the stolen data in further phishing attempts, which may use calls, texts, or emails to ask for passwords, MFA codes, or other credentials. ShinyHunters links While Optimizely didn't share how many customers had their information exposed in the data breach and has yet to name the threat actor behind the attack, it told affected customers that "the communication we received is consistent with the behavior of a loosely affiliated group who use sophisticated and aggressive social engineering tactics, most often involving voice phishing, to attempt to access their victims systems." This hints that the attackers are likely part of the ShinyHunters extortion operation, which has claimed similar breaches at Canada Goose, Panera Bread, Betterment, SoundCloud, PornHub, fintech firm Figure, and online dating giant Match Group (which owns multiple popular dating services, including Tinder, Hinge, Meetic, Match.com, and OkCupid) in recent weeks. While not all of these breaches are part of the same campaign, some victims had their systems compromised in a voice phishing (vishing) campaign targeting single sign-on (SSO) accounts at Microsoft, Okta, and Google across over 100 high-profile organizations. In these attacks, threat actors impersonate targets' IT support, call employees, and trick them into entering credentials and multi-factor authentication (MFA) codes on phishing sites mimicking their companies' login portals. As BleepingComputer first reported, the threat actors have also recently altered their social engineering attacks to use device code vishing, abusing the legitimate OAuth 2.0 device authorization grant flow to obtain Microsoft Entra authentication tokens. Once in, they hijack the victim's SSO account and gain access to connected enterprise services, including Salesforce, Microsoft 365, Google Workspace, Zendesk, Dropbox, SAP, Slack, Adobe, Atlassian, and many others. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report