CarMax Data Breach Exposes 451,388 Customer Phone Numbers

HEROIC analysts identified a data breach affecting CarMax, dated January 2026, that exposed 451,388 customer records. The exposed data includes email addresses, first and last names, and phone numbers pulled directly from the company's own systems. No passwords were part of this incident, but the personal details involved are enough on their own to enable targeted scams, so scanning your email is the clearest way to check whether your information was included.

Why This Is Dangerous

Even without a password in the mix, a real name paired with a phone number and email address is exactly what a convincing scam needs. Someone using this data can pose as CarMax, a bank, or another familiar brand and sound credible enough to get a victim to hand over more. That kind of targeted approach tends to work better than a generic message sent to a stranger.

What Was Exposed

• Email Address
• First Name
• Last Name
• Phone Number

The real-world risk here leans toward phishing and impersonation rather than direct account takeover. Victims may receive calls or texts that reference their actual name and contact details, making a scam attempt feel legitimate right up until money or further information is requested. Some of this data can also feed into broader identity theft schemes when combined with information from other sources.

A breach like this one happens when data is taken directly from a company's own systems rather than harvested from individual devices or compiled from scattered lists elsewhere. That means the exposure traces back to a single point of failure inside the organization holding the data, not to malware or password reuse on the customer's end. Once removed, that data circulates independently of whatever the company does afterward.

See If Your Information Was in This Breach

Scan your email to check whether your details appear in this exposure.

• Be cautious of unexpected calls or texts referencing your name or contact details, especially ones asking for personal information.
• Consider how your phone number and email are used elsewhere, since both are now more likely to attract targeted scam attempts.

This applies whether the exposed email is one you use personally or for work.