Carhartt Data Breach: Claims of 50M Records Found to be Exaggerated

The ShinyHunters hacking group claimed to have compromised Carhartt, alleging a theft of over 50 GB of data, including customer records and employee information. However, cybersecurity expert Troy Hunt analyzed the data and found only 12.9 million unique email addresses were affected, significantly less than the hackers claimed. Hunt's analysis revealed that much of the data was synthetic, with anomalies such as email addresses from non-relevant domains and implausible demographic information. The breach was initially reported on August 13, 2026, after Carhartt's failed negotiations with the hackers. Hunt utilized his Email Address Extractor and OpenClaw tools to sift through the data, ultimately determining that only a fraction of the reported records were genuine. This incident highlights the importance of verifying claims made by cybercriminals before taking action. The current status indicates that the breach has been confirmed but the extent of the impact is much lower than initially reported.

Key Points: • ShinyHunters claimed a breach affecting over 50 million records, later verified to be 12.9 million. • Troy Hunt's analysis revealed synthetic data injection in the leaked dataset. • The breach emphasizes the need for skepticism regarding claims made by cybercriminals.