2026 Carhartt — ShinyHunters dump; HIBP loads 12,933,413 emails (synthetic padding removed)
Data compromised
HIBP: email addresses, names, phone numbers, physical addresses (12.9M unique emails after de-padding)
Technical writeup
Independent HIBP verification of a ShinyHunters dump — Troy Hunt / The Register August 26, 2026. ShinyHunters published alleged Carhartt customer data around August 13 after a pay-or-leak campaign (actor narrative cited a ~$3.3M demand). A raw unique-email extract yielded ~24.9M addresses; Hunt documented extensive synthetic/TPC-DS-style padding (bogus .edu/.org domains, implausible geographies and birth dates). After cleanup, HIBP loaded 12,933,413 unique emails with names, phones, and physical addresses; ~83% were already in prior HIBP breaches. Carhartt had not publicly confirmed in Register reporting. recordsAffected 12933413 from HIBP; companyConfirmed false pending retailer notice.
Root cause
ShinyHunters pay-or-leak dump (~50GB claimed) mid-August 2026; HIBP verification removed millions of synthetic TPC-DS-style rows; Carhartt had not publicly confirmed at Register indexing