Carvana has notified people that a document containing their personal information was inadvertently disclosed on September 30, 2026. The company says it has been in contact with the recipient and has no evidence the information has been misused.
Carvana’s Data Breach Investigation
Carvana is an online used car retailer that sells vehicles to customers across the United States. The company handles customer records tied to vehicle purchases, financing, registration and delivery, and those records can include names, addresses, driver’s license numbers and dates of birth.
This incident is described as an inadvertent disclosure rather than a cyberattack. According to the notice letter that went to affected people, Carvana discovered on September 30, 2026 that a document containing the recipient’s personal information was disclosed by mistake. The letter says the company has been in contact with the recipient of the document and has no evidence or reason to believe the information has been misused.
The notice letter is dated October 5, 2026 and was sent by USPS certified mail. A copy was filed with the Massachusetts state government, which posts breach notification letters it receives. The filing is listed under Carvana HC LLC, and the letter itself is signed by the Carvana Privacy Team.
The letter does not say how many people were affected, who received the document, or how the disclosure happened. No total has been published in the sources reviewed for this page. This page is based on the notice letter alone, and nothing here should be read as a claim about the cause or scale of the incident beyond what the company has stated.
As a precaution, Carvana says it is offering free identity theft protection through IDX, a ZeroFox company. The services include 12 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and fully managed identity theft recovery services. The letter says people should enroll within 60 days of receiving it, and that the deadline to enroll is March 16, 2027.
The letter also notes two rights under Massachusetts law: people have the right to obtain a police report, and they may request a security freeze from the credit bureaus at no charge. The company says it is coordinating with relevant authorities to help ensure incidents like this are avoided in the future.
A full name, date of birth, driver’s license number, home address, email address and phone number together give a scammer a lot to work with. Even without a Social Security number, that combination can support impersonation, attempts to open accounts or obtain credit in someone else’s name, and convincing phishing messages that appear to come from a car lender or retailer.
Notice letters are normally the first reliable source of specifics for each person. Keep any letter you receive, along with its enrollment code, and read it closely for deadlines and contact details. If you were not sent a notice, there is no reason to assume your information was involved.
When Did This Breach Occur?
According to the notice letter, Carvana discovered on September 30, 2026 that a document containing personal information had been inadvertently disclosed. The letter is dated October 5, 2026. It does not state when the document was disclosed, only when the company discovered it.
What Information Was Breached?
The notice letter says the personal information believed to have been disclosed included a person’s full name, date of birth, driver’s license number, home address, email address and phone number. The company says it has no evidence or reason to believe the information has been misused.
What You Can Do
If you received a notice from Carvana, consider these steps:
- Keep the letter and enroll in the free IDX identity protection services before the March 16, 2027 deadline.
- Consider a free security freeze or fraud alert with Equifax, Experian and TransUnion.
- Check your credit reports for free at annualcreditreport.com and review account statements for anything you do not recognize.
- Be cautious with unexpected calls, texts or emails that mention your vehicle or this incident, and confirm any request through a phone number you already trust.
- Report suspected identity theft to the Federal Trade Commission at identitytheft.gov and to your state Attorney General.
File a Data Breach Lawsuit Against Carvana
If you received a notice about this incident, or believe your driver’s license number or other personal information was exposed, you may have legal options. Companies that hold sensitive customer records are expected to safeguard them, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
