Have I Been Pwned says ShinyHunters targeted Carhartt in an August "pay or leak" extortion campaign and later published data including about 12.9 million unique emails with names, phone numbers and physical addresses, excluding millions of synthetic records [1]. According to BleepingComputer, ShinyHunters published about 50GB of data after Carhartt declined a $3.3 million ransom, and Troy Hunt linked the breach to a compromise of Carhartt's Databricks analytics platform, which Carhartt has not confirmed [2]. Carhartt customers should check their email on Have I Been Pwned, change related passwords and enable two-factor authentication, and beware of scams using their name and address [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Aug 25, 2026 and we added it on Nov 11, 2026. It is not a new event.
HighActiveBackfillMedia reported
Carhartt data published after ShinyHunters extortion fails, exposing contact details of about 12.9 million accounts
1 min read
- Disclosed
- Aug 25, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- Scale
- 12,900,000 accounts[1]
- CVSS basis
- Our assessment
- Technology
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
Timeline
Technical details
Remediation
Vendor guidance
- 1Check exposure verify[1]
Check your email on Have I Been Pwned, change passwords and enable 2FA.
References
Research1
- [1]
“The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses.”
Media1
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.