Have I Been Pwned has loaded Carhartt at 12,933,413 unique emails after ShinyHunters published a padded dump in mid-August 2026 — about half the raw address count criminals marketed. Troy Hunt documented millions of TPC-DS-style synthetic rows mixed into the corpus. Carhartt had not publicly confirmed at The Register’s August 26 write-up. Canonical: carhartt-shinyhunters-hibp2026. Sources: HIBP, Troy Hunt, The Register.
This is the cautionary tale HIBP was built for. ShinyHunters dumped what it called ~50GB after a pay-or-leak fight (actor narrative cited a $3.3M demand and an “incompetent negotiator”). A naive unique-email extract spat out nearly 25 million addresses. After Hunt and tooling stripped synthetic domains, impossible geographies, and deactivated clutter, the real floor landed near 12.9 million — and HIBP notes ~83% of those emails were already in prior breaches.
What data is in the Carhartt HIBP load
HIBP’s Carhartt breach page lists email addresses, names, phone numbers, and physical addresses. That is classic retail CRM phishing fuel: “your Detroit order needs a card re-auth” lures that already know your street.
What this is not
To be clear: Carhartt had not issued a public company confirmation in the Register reporting reviewed at indexing. HIBP’s load is independent corpus verification, not a substitute for a retailer notice. Payment-card scope was not the HIBP field list — do not invent card exposure from a CRM dump.
Who is at risk
Customers whose emails land in HIBP’s Carhartt breach. Employees if work addresses were in the same tables. Anyone who reuses a Carhartt-site password elsewhere.
ShinyHunters context
Summer 2026 ShinyHunters listings repeatedly padded or oversold Salesforce-scale hauls. Carhartt is the clearest public case where HIBP published the verification math. Treat other actor “25M” headlines the same way until someone does the work.
Action items
- Check your address on Have I Been Pwned for the Carhartt breach.
- Change any reused password tied to that email; enable MFA on email and shopping accounts.
- Ignore Carhartt-branded SMS/email payment links; use the bookmark you already trust.
- Watch for package-redelivery and loyalty-point scams citing your city.
- Freeze credit if you later receive a retailer letter listing SSN/financial fields not in the HIBP summary.
Canonical record and sources
Catalog: carhartt-shinyhunters-hibp2026 — recordsAffected 12933413 (HIBP). Related ShinyHunters rows: CyrusOne, ReliaQuest.
Search coverage: Carhartt data breach, Carhartt ShinyHunters, HIBP Carhartt 12.9 million, synthetic data padding breach, was I affected Carhartt, retail CRM phishing 2026.
Phishing after a named retailer dump usually arrives before any polished FAQ. Attackers need a headline and a few accurate address fields — not your regulator’s timeline.
Synthetic padding in actor dumps is why Have I Been Pwned spends hours verifying before loading. Treat raw forum counts as marketing until HIBP or a company notice lands.
Secondary scams include fake “Carhartt loyalty refund” bots, fake electoral “update your cedula” portals, and monitoring signups that harvest more data than they protect.
If you forward breach news in work Slack, forward Troy Hunt / HIBP or Cyberattaque URLs and the BreachHistory canonical link — not a forum sales screenshot.
Support agents become social-engineering targets when CRM and invoice context leak. Brief them early.
International customers should not assume “US only.” Personalized lures travel with the email address.
Call-center staff should use out-of-band verification when a caller recites recent trivia. Accuracy is not authentication.
Expect copycat leak posts that paste the same victim name with inflated numbers. Check dates and primary URLs.
Legal teams drafting notices should wait for inventory rather than marketing every actor CSV as gospel.
Open bookmarks to official portals now so you are not searching under panic later.
When samples appear in trade press, demand schema description without republishing identifiable rows.
Partners reading this as a peer incident should tabletop: Sunday dump, same-day holding statement, and customer SMS without payment links.
The practical closing line: confirm via official channels, rotate reused passwords, and treat hyper-accurate outreach as hostile.
Merchants whose customers appear in a loyalty dump still own the customer relationship — and the phishing blowback.
Rotate API keys and webhook secrets whenever a Metabase or BlgCloud stack is named in a leak claim, even before confirmation.
Electoral-authority dumps with ID photographs enable deepfake and SIM-swap campaigns that ordinary email dumps do not.
TPA and benefits-admin breaches hit people who never chose the vendor — brokers should push MFA and cyber insurance questions into RFPs.
Museum and cultural-institution HR dumps often sit quiet for months before letters go out — calendar reminders beat hope.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.
BreachHistory revises rows when primary notices revise counts or confirm actor claims. Actor floors are scaffolding, not scripture — treat leak-site inventories as labeled claims until the victim or a regulator attests.