Carhartt data breach exposes 12.9 million accounts

The ShinyHunters extortion group has published sensitive data from 12.9 million Carhartt accounts after the clothing retailer declined a $3.3 million ransom demand earlier this month.

ShinyHunters stole more than 50GB of data from Carhartt's Databricks analytics platform. The group claimed the breach on August 13 and later released an archive of the records on its dark web leak site after Carhartt refused to negotiate. Have I Been Pwned founder Troy Hunt analyzed the 50GB dump and confirmed it originated from the compromise of Carhartt's Databricks platform, according to multiple reports including The Register and WebProNews.

The exposed information includes unique email addresses, names, phone numbers, and physical addresses. Hunt excluded millions of synthetic records generated for testing that did not relate to real individuals, narrowing the breach to exactly 12,933,413 genuine accounts. The Register reports that 83% of these records had already appeared in prior breaches.

Carhartt has not confirmed the incident or issued a public statement. The company told ShinyHunters through a negotiator that after internal discussions with leadership it decided not to move forward with negotiations or further discussions. A Carhartt spokesperson was not immediately available for comment when BleepingComputer reached out.

The breach also includes records on more than 15,000 Carhartt employees. Hunt identified over 15,000 @carhartt.com email addresses in the leaked database. ShinyHunters had claimed the stolen material contained customer data, employee information, royalty details, and other internal corporate records.

ShinyHunters has a track record of targeting cloud platforms and third-party providers. Over the past year the group has been linked to breaches at over a dozen Snowflake customers and claimed responsibility for attacks on hundreds of Salesforce customers, saying it stole more than 1.5 billion records. Most recently ShinyHunters claimed a series of breaches at more than 100 organizations by exploiting an Oracle PeopleSoft zero-day flaw. Affected organizations it has named include the European Commission, Google, Cisco, Match Group, PornHub, Vimeo, Rockstar Games, McGraw Hill, 7-Eleven, Carnival, Udemy, and Medtronic.