Carhartt data breach exposes 12.9 million customer accounts

In late August 2026, American workwear and apparel maker Carhartt, Inc. was the target of a ShinyHunters "pay-or-leak" extortion campaign that exposed the personal information of millions of its customers. After the retailer reportedly rejected the group's roughly $3.3 million demand, ShinyHunters published data it claimed to have stolen and blamed the failed negotiations on Carhartt's response.

On 26 August 2026, the breach-notification service Have I Been Pwned completed its analysis of the leaked material, confirming 12.9 million unique email addresses belonging to real users — roughly half the figure ShinyHunters had initially claimed. The exposed records also included customer names, phone numbers and physical addresses.

What happened

Security researchers, including Have I Been Pwned's Troy Hunt, linked the incident to the compromise of Carhartt's Databricks cloud analytics platform, where customer and business data had been aggregated. The breach followed the broader 2026 wave of ShinyHunters campaigns that targeted enterprise SaaS and data-warehouse environments to bulk-extract customer datasets before extortion.

Why it matters

The Carhartt breach is a reminder that consolidating customer data into cloud analytics and warehousing platforms concentrates risk: a single compromised environment can expose tens of millions of records at once. It also highlights the recurring gap between attackers' inflated victim claims and the verifiable exposure — here, independent analysis put the real figure at roughly half of what the extortion group advertised.