Security researcher Troy Hunt found that Carhartt's data breach, claimed by the extortion group ShinyHunters, affected roughly 12.9 million people—about half the number the criminals originally claimed. After Carhartt reportedly hired a negotiator to talk down the group's $3.3 million extortion demand, ShinyHunters released around 50GB of data on 13 August, but Hunt's analysis, feeding it to the Have I Been Pwned (HIBP) site, revealed the dataset had been heavily padded with synthetic entries to inflate its apparent scale.

Using an email extraction tool followed by AI analysis, Hunt's process flagged millions of suspicious .edu and .org addresses with randomised domains, alongside implausible details such as customers registered in Benin and Montenegro, and unusually large numbers of birth dates from the early 1900s. This filtering cut the estimated genuine records from an initial 24.8 million down to 13.6 million, and after removing further duplicates and dead addresses, Hunt confirmed 12,933,413 authentic accounts—of which 83% had already appeared in previous breaches. The real data includes names, email addresses, phone numbers and physical addresses; Carhartt has not publicly commented on the breach or responded to requests regarding Hunt's findings.