Edmunds Hack Exposes Passwords and Emails for 188,202 Accounts

HEROIC analysts confirmed that Edmunds, an automotive research platform, was affected by a data breach on January 24, 2026, exposing 188,202 records. The exposed data included email addresses, usernames, plaintext passwords, password hashes, and IP addresses. The only way to know for certain whether your own information is part of this exposure is to scan your email.

What Someone Could Do With This Combination

Passwords exposed in plaintext, or even as hashes, mean the account they belong to is at risk, along with every other account where that same password was reused. Paired with a username, email address, and IP address, an attacker has enough to attempt a direct account takeover or to test the same credentials across other sites.

The Specific Data Involved

• Email Address
• Username
• Plaintext Password
• Password Hash
• IP Address

The Real-World Impact

Because this exposure has been confirmed, the risk is concrete rather than hypothetical. A plaintext password can be used immediately, and even a hashed password can sometimes be cracked and reused. If you've used the same password anywhere else, those accounts are at risk too, which is why reused passwords are one of the most common ways a single exposure turns into several.

How Data Like This Typically Gets Out

HEROIC analysts confirmed that this data was taken from the company's own systems rather than collected one device at a time through malware. In practice, this usually means a customer database was accessed without authorization and the information later began circulating.

Was Your Password Exposed in This Edmunds Breach?

The fastest way to find out is to scan your email. If your information turns up, change the password on this account immediately, along with the password on any other account where you reused it. Check both your personal and work email addresses, since either one could be tied to an account in a dataset like this.