<p>据一个臭名昭著的网络犯罪团伙称，CarGurus 遭遇数据泄露，170 万条企业记录被盗，该团伙在周三将这一在线汽车市场发布在其泄露网站上。</p>
<p>ShinyHunters 在其公告中写道：“这是最后一次警告，请在 2026 年 2 月 20 日之前联系，否则我们将泄露，并伴随一些烦人的（数字）问题。” 该公告被《注册》杂志看到并在社交媒体上分享。数字犯罪分子声称被泄露的文件包括个人身份信息和 “其他内部企业数据”。</p>
<p>CarGurus 尚未立即回应《注册》杂志的询问。我们将在收到公司的回复后更新此故事。</p>
<p>我们也联系了 ShinyHunters，想了解他们何时以及如何入侵该汽车购物网站，但没有收到立即回复。</p>
<p>周三的帖子标志着 ShinyHunters 和 Scattered Lapsus$ Hunters 自年初以来声称的 15 起数据泄露事件的结束，包括对两家投资顾问公司 Mercer Advisors 和 Beacon Pointe Advisors 的渗透，这两家公司在周日被列出。</p>
<p>勒索者设定了周三的最后期限，要求这两家公司进行谈判，并威胁要泄露来自 Mercer 的 500 万条记录和来自 Beacon Pointe 的 10 万条记录。这两家公司都没有发布数据泄露通知，也没有回应《注册》杂志的评论请求。</p>
<p>至少有一家被 ShinyHunters 入侵并在其泄露网站上发布的公司在 2 月份表示，该泄露源于一次旧的袭击。周一，加拿大鹅告诉我们，它 “意识到与过去客户交易相关的历史数据集最近已在网上发布。”</p>
<p>然而，这家羽绒服供应商拒绝透露数据的具体年龄或最初是如何被盗的。</p>
<p>区块链借贷公司 Figure Technology Solutions 上周也被列在 ShinyHunters 的泄露网站上，且根据 Have I Been Pwned，犯罪分子盗取了近 100 万名客户的记录。</p>
<p>Figure 的一位发言人告诉我们，“一名员工遭遇了社交工程攻击，这使得攻击者能够通过他们的账户下载有限数量的文件。”</p>
<ul>
<li>加拿大鹅因 60 万条记录泄露而感到不安，称泄露是旧闻</li>
<li>Betterment 数据泄露可能暴露 140 万用户，因社交工程攻击</li>
<li>ShinyHunters 在涉嫌约会应用数据抓取中盗取 1000 万条记录</li>
<li>让他们吃酸面包：ShinyHunters 声称 Panera Bread 是被盗凭证的受害者</li>
</ul>
<p>发言人的声明通过电子邮件继续说道：“我们迅速采取行动阻止了这一活动，并聘请了一家法医公司调查受影响的文件。我们理解这些问题的重要性，并正在与合作伙伴和受影响者进行适当的沟通。”</p>
<p>该公司还表示，正在增加 “保护措施和培训” 以增强其数字防御，并为所有受影响的个人提供免费的信用监控服务。</p>
<p>其他近期受害者包括投资平台 Betterment、Match Group（在入侵期间 Hinge、Match.com 和 OkCupid 等约会网站受到影响）、Panera Bread，以及汽车购买和评论网站 Carvana 和 Edmunds。</p>
<p>ShinyHunters 之前告诉《注册》杂志，它通过语音钓鱼获取了 Betterment 的系统访问权限，使用了 Okta 单点登录（SSO）代码，并通过 Microsoft Entra SSO 代码入侵了 Panera。犯罪分子的发言人表示，CarMax 和 Edmunds 的泄露源于早期无关的入侵。®</p>

CARG

<p>据报道，CarGurus 经历了一次数据泄露事件，黑客组织 ShinyHunters 盗取了 170 万条企业记录。该组织威胁称，除非在 2026 年 2 月 20 日之前与其联系，否则将泄露包括个人身份信息在内的数据。这一事件是 ShinyHunters 今年声称的多起数据泄露事件之一，影响了包括投资公司和其他在线平台在内的多家公司。CarGurus 尚未对有关此次泄露的询问作出回应</p>

<p>CarGurus allegedly suffered a data breach with 1.7 million corporate records stolen, according to a notorious cybercrime crew that posted the online vehicle marketplace on its leak site on Wednesday.</p>
<div class="lb-trans"><p>据一个臭名昭著的网络犯罪团伙称，CarGurus 遭遇数据泄露，170 万条企业记录被盗，该团伙在周三将这一在线汽车市场发布在其泄露网站上。</p>
</div><p>&#34;This is a final warning to reach out by 20 Feb 2026 before we leak along with several annoying (digital) problems that'll come your way,&#34; ShinyHunters wrote in its announcement, seen by <em>The Register</em> and shared on social media. The digital crooks claimed the compromised files included personally identifiable information and &#34;other internal corporate data.&#34;</p>
<div class="lb-trans"><p>ShinyHunters 在其公告中写道：“这是最后一次警告，请在 2026 年 2 月 20 日之前联系，否则我们将泄露，并伴随一些烦人的（数字）问题。” 该公告被《注册》杂志看到并在社交媒体上分享。数字犯罪分子声称被泄露的文件包括个人身份信息和 “其他内部企业数据”。</p>
</div><p>CarGurus did not immediately respond to <em>The Register</em>'s inquiries. We will update this story when we hear back from the company.</p>
<div class="lb-trans"><p>CarGurus 尚未立即回应《注册》杂志的询问。我们将在收到公司的回复后更新此故事。</p>
</div><p>We also reached out to ShinyHunters to find out when and how they breached the car shopping site, but did not receive an immediate response.</p>
<div class="lb-trans"><p>我们也联系了 ShinyHunters，想了解他们何时以及如何入侵该汽车购物网站，但没有收到立即回复。</p>
</div><p>The Wednesday posts cap a string of 15 breaches claimed by ShinyHunters and Scattered Lapsus$ Hunters since the beginning of the year, including penetrating two investment advisory firms, Mercer Advisors and Beacon Pointe Advisors, listed on Sunday.</p>
<div class="lb-trans"><p>周三的帖子标志着 ShinyHunters 和 Scattered Lapsus$ Hunters 自年初以来声称的 15 起数据泄露事件的结束，包括对两家投资顾问公司 Mercer Advisors 和 Beacon Pointe Advisors 的渗透，这两家公司在周日被列出。</p>
</div><p>The extortionists set a Wednesday deadline for both companies to negotiate and threatened to leak 5 million records from Mercer and 100,000 from Beacon Pointe. Neither firm has posted a breach notification, and they did not respond to <em>The Register</em>'s requests for comment.</p>
<div class="lb-trans"><p>勒索者设定了周三的最后期限，要求这两家公司进行谈判，并威胁要泄露来自 Mercer 的 500 万条记录和来自 Beacon Pointe 的 10 万条记录。这两家公司都没有发布数据泄露通知，也没有回应《注册》杂志的评论请求。</p>
</div><p>At least one of the companies allegedly breached by ShinyHunters and posted to its leak site in February has said the compromise is from an old raid. On Monday, Canada Goose told us that it was &#34;aware that a historical dataset relating to past customer transactions has recently been published online.&#34;</p>
<div class="lb-trans"><p>至少有一家被 ShinyHunters 入侵并在其泄露网站上发布的公司在 2 月份表示，该泄露源于一次旧的袭击。周一，加拿大鹅告诉我们，它 “意识到与过去客户交易相关的历史数据集最近已在网上发布。”</p>
</div><p>The down-filled jacket purveyor, however, declined to say how old the data is or how it was originally stolen.</p>
<div class="lb-trans"><p>然而，这家羽绒服供应商拒绝透露数据的具体年龄或最初是如何被盗的。</p>
</div><p>Blockchain lending firm Figure Technology Solutions was also listed on ShinyHunters' leak site last week, and according to Have I Been Pwned, the criminals stole nearly 1 million customers' records.</p>
<div class="lb-trans"><p>区块链借贷公司 Figure Technology Solutions 上周也被列在 ShinyHunters 的泄露网站上，且根据 Have I Been Pwned，犯罪分子盗取了近 100 万名客户的记录。</p>
</div><p>A Figure spokesperson told us that &#34;an employee was socially engineered, and that allowed an actor to download a limited number of files through their account.&#34;</p>
<div class="lb-trans"><p>Figure 的一位发言人告诉我们，“一名员工遭遇了社交工程攻击，这使得攻击者能够通过他们的账户下载有限数量的文件。”</p>
</div><ul>
<li>Canada Goose ruffles feathers over 600K record dump, says leak is old news</li>
<li>Betterment breach may expose 1.4M users after social engineering attack</li>
<li>ShinyHunters swipes right on 10M records in alleged dating app data grab</li>
<li>Let them eat sourdough: ShinyHunters claims Panera Bread as stolen credentials victim</li>
</ul>
<div class="lb-trans"><ul>
<li>加拿大鹅因 60 万条记录泄露而感到不安，称泄露是旧闻</li>
<li>Betterment 数据泄露可能暴露 140 万用户，因社交工程攻击</li>
<li>ShinyHunters 在涉嫌约会应用数据抓取中盗取 1000 万条记录</li>
<li>让他们吃酸面包：ShinyHunters 声称 Panera Bread 是被盗凭证的受害者</li>
</ul>
</div><p>&#34;We acted quickly to block the activity and retained a forensic firm to investigate what files were affected,&#34; the spokesperson's statement, sent via email, continued. &#34;We understand the importance of these matters and are communicating with partners and those impacted as appropriate.&#34;</p>
<div class="lb-trans"><p>发言人的声明通过电子邮件继续说道：“我们迅速采取行动阻止了这一活动，并聘请了一家法医公司调查受影响的文件。我们理解这些问题的重要性，并正在与合作伙伴和受影响者进行适当的沟通。”</p>
</div><p>The company also said it is adding &#34;safeguards and training&#34; to boost its digital defenses, and offering free credit monitoring to all affected individuals.</p>
<div class="lb-trans"><p>该公司还表示，正在增加 “保护措施和培训” 以增强其数字防御，并为所有受影响的个人提供免费的信用监控服务。</p>
</div><p>Other recent victims include investment platform Betterment, Match Group (with dating sites Hinge, Match.com, and OkCupid compromised during the intrusion), Panera Bread, and car buying and review sites Carvana and Edmunds.</p>
<div class="lb-trans"><p>其他近期受害者包括投资平台 Betterment、Match Group（在入侵期间 Hinge、Match.com 和 OkCupid 等约会网站受到影响）、Panera Bread，以及汽车购买和评论网站 Carvana 和 Edmunds。</p>
</div><p>ShinyHunters previously told <em>The Register</em> that it gained access to Betterment's systems by voice phishing its Okta single sign-on (SSO) codes, and Panera via a Microsoft Entra SSO code. The criminals' spokesperson said the CarMax and Edmunds breaches were from earlier, unrelated intrusions. ®</p>
<div class="lb-trans"><p>ShinyHunters 之前告诉《注册》杂志，它通过语音钓鱼获取了 Betterment 的系统访问权限，使用了 Okta 单点登录（SSO）代码，并通过 Microsoft Entra SSO 代码入侵了 Panera。犯罪分子的发言人表示，CarMax 和 Edmunds 的泄露源于早期无关的入侵。®</p>
</div>

据称，ShinyHunters 窃取了 170 万条 CarGurus 的记录