Carhartt breach exposed data of about 12.9 million people
Security researcher Troy Hunt found that Carhartt's data breach, claimed by the extortion group ShinyHunters, affected roughly 12.9 million people—about half the number the criminals originally claimed. After Carhartt reportedly hired a negotiator to talk down the group's $3.3 million extortion demand, ShinyHunters released around 50GB of data on 13 August, but Hunt's analysis, feeding it to the Have I Been Pwned (HIBP) site, revealed the dataset had been heavily padded with synthetic entries to inflate its apparent scale.
Using an email extraction tool followed by AI analysis, Hunt's process flagged millions of suspicious .edu and .org addresses with randomised domains, alongside implausible details such as customers registered in Benin and Montenegro, and unusually large numbers of birth dates from the early 1900s. This filtering cut the estimated genuine records from an initial 24.8 million down to 13.6 million, and after removing further duplicates and dead addresses, Hunt confirmed 12,933,413 authentic accounts—of which 83% had already appeared in previous breaches. The real data includes names, email addresses, phone numbers and physical addresses; Carhartt has not publicly commented on the breach or responded to requests regarding Hunt's findings.
- Carhartt breach hit 12.9 million people, half of ShinyHunters' claimed total.
- Troy Hunt used AI to detect synthetic data padding out the leak.
- 83% of confirmed records had already appeared in prior breaches.
New here? Start with this
Carhartt is a US clothing company best known for workwear. A data breach is when information held by an organisation is accessed or taken without permission; the stolen records in this case include contact details such as names, email addresses, phone numbers and home addresses.
ShinyHunters is an extortion group that has claimed responsibility for breaches at companies and demanded money. Troy Hunt is a security researcher who runs Have I Been Pwned, a service that lets people check whether their email addresses appear in known data breaches.
Stolen contact details can expose people to scams and unwanted messages, and may be combined with information from other breaches. Many of the affected accounts had already appeared in earlier breaches, but the data can still matter because it may bring personal details together in one place.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Companies holding millions of personal records—names, addresses, phone numbers—have a fundamental responsibility to protect that data and communicate transparently when they fail. Carhartt's complete public silence about a breach affecting 12.9 million customers is troubling, because individuals deserve to know what information was exposed, the genuine risks they face, and what steps the company is taking to prevent future incidents. Transparency is essential for accountability and for helping people take protective measures if needed.
The case against
Carhartt may be exercising justified caution in a complex situation. Security researchers confirmed that criminals significantly padded the released dataset, and 83 per cent of the exposed records had already appeared in previous breaches, meaning the incremental new risk to customers is more limited than initially feared. The company negotiated the extortion demand down rather than capitulating, and consulting legal counsel before making public statements about breaches is standard practice that can prevent further attacks and protect ongoing investigations. A measured response is not necessarily irresponsible.
AI Art Culture Cybersecurity Technology
Read the full article at the source →
Originally published by The Register as “Carhartt data breach affects 12.9M, half of what ShinyHunters claimed”.