01Summary
ShinyHunters dumped about 50 GB of Carhartt data on 13 August 2026 after mocking the company's "very unskilled and incompetent negotiator", who had tried to talk the group down from a US$3.3 million demand. Troy Hunt traced the data to a compromise of Carhartt's Databricks analytics platform. It contains 12,933,413 accounts with emails, names, phone numbers, addresses and loyalty details, including more than 15,000 belonging to staff. The group had claimed more than twice as many records.
02Victims and impact
Countries affected
- United States
03Data exposed
Data types
- Email addresses
- Names
- Phone numbers
- Physical addresses
- Loyalty details
04Timeline
- 2026-08-13ShinyHunters publishes the 50 GB archive.
- 2026-08-26Have I Been Pwned confirms 12.9 million accounts.
05Disclosure and media
Publishing organisations
- The Register
- BleepingComputer
- TechRadar
06Sources
References
- [1]The Register: https://www.theregister.com/security/2026/08/26/carhartt-data-breach-affects-129m-half-of-what-shinyhunters-claimed/5292626
- [2]Have I Been Pwned: https://haveibeenpwned.com/Breach/Carhartt