carmax.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of 545,039 historical data breaches and 15,337 active infostealer logs associated with carmax.com. The majority of the exposure stems from database dumps (82.2%) and combolist sources (17.8%), with malware families like Redline and Rhadamanthys being prevalent. The timeline shows a surge in employee and client-related events in April 2026, coinciding with a large number of client-related events. Targeted services include authentication endpoints like idp.carmax.com and login portals, primarily originating from the United States. Given the high volume of historical data breaches and the presence of active infostealer logs, the risk priority is critical. The focus for remediation should be on comprehensive data breach investigation, credential stuffing prevention, and strengthening authentication mechanisms to mitigate further compromise of employee and client data. The prevalence of infostealer malware suggests a need for enhanced endpoint security and user awareness training.