carvana.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of client data, with over 154,000 client records compromised, alongside 6,400 employee records. This exposure is primarily driven by historical data breaches and active infostealer logs, accounting for 86.3% and 13.7% of the event family segmentation respectively. The timeline shows a notable surge in employee and client compromises in January 2026, with employee compromises peaking at 4,551 and client compromises at 10,298 during that month. The majority of the compromised data originates from "Combolist sources" (96.1%), suggesting credential stuffing or similar attacks leveraging previously leaked credentials. Malware families like Rhadamanthys, LummaC2, and Redline are prevalent, indicating active exploitation and data exfiltration activities. The targeted services are predominantly related to carvana.com, including its main domain and financing prequalification pages, with the United States being the primary geographic origin of the exposure.