CarGurus users face a security risk after the ShinyHunters hacking group allegedly leaked 12.4 million records containing names, addresses and finance data.