Confirmed breach

Edmunds data breach

Country being checked · edmunds.com

A breach of Edmunds was added to Have I Been Pwned’s breach database on 1 June 2026. It affected 177,860 accounts. Exposed: Passwords and logins, Email addresses, Phone numbers, Usernames, IP addresses and Device information. The breach began on 24 January 2026, 128 days before it was reported.

Status

Confirmed breach

People affected

177,860 accounts

Reported

1 June 2026

Breach began

24 January 2026

Time to tell

128 days (the median in California’s notices over the last year: 154 days)

What was exposed

• Passwords and logins
• Email addresses
• Phone numbers
• Usernames
• IP addresses
• Device information

Sources

• Breach database · 1 June 2026 · 177,860 accountsHave I Been Pwned

Breach databases are read by code. · Corrections and changes

If Edmunds had your data

1. Look for Edmunds’s own notice or letter: it should say what of yours was involved. Keep it.
2. Change your Edmunds password, and the same password anywhere else you use it. Turn on two-step sign-in.
3. Expect scams that use your details: calls, texts or emails pretending to be Edmunds, your bank or the police. Never give codes or passwords, never approve a sign-in you did not start, never move money.

• Spot the scams that use leaked data →
• If your password leaked →
• What to do after a data breach →

Email me if Edmunds has another breach

Alert me

One email to confirm first. We use your address only for this alert, and one click deletes it.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Found a mistake? Tell us and we correct it.