Back haveibeenpwned.com

Carhartt

haveibeenpwned.com • August 26, 2026

In August 2026, clothing retailer Carhartt was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses. The published corpus also contained millions of synthetic records that did not relate to real individuals and were excluded from the breach.

Use a password manager to generate and store strong, unique passwords for all your accounts. 1Password helps protect your data with industry-leading security.

If you haven’t already changed the password affected by this breach, do so immediately on every account where it was used.

Wherever 2FA is supported, add an extra layer of security to your account.

Use a password manager to generate and store strong, unique passwords for all your accounts. 1Password helps protect your data with industry-leading security.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Carhartt Data Breach Exposes 12.9 Million Accounts The ShinyHunters hacking group claims to have compromised Carhartt, stealing sensitive data from nearly 13 million accounts. The breach, which occurred on August 13, 2026, involved over 50GB of data, including customer and employee information. Troy Hunt, founder of Have I Been Pwned, analyzed the leaked data and found that while ShinyHunters claimed 24.8 million email addresses were exposed, the actual number of affected individuals was around 12.9 million. The data included unique email addresses, names, phone numbers, and physical addresses, but also contained millions of synthetic records that were not real individuals. Carhartt has not confirmed the breach or issued a public statement. The group attempted to extort Carhartt for $3.3 million but was rebuffed. Hunt's analysis revealed anomalies in the data, indicating that much of it was fabricated. The breach highlights the importance of verifying claims made by cybercriminals. 7 sources 62

Extracted Entities

Carhartt

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)

MITRE ATT&CK (1)