{"id":"carhartt-customer-data-published-aug-2026","category":"breach","status":"closed","title":"Data attributed to Carhartt published with 12.9 million email addresses","tldr":"ShinyHunters published data attributed to Carhartt containing 12.9 million unique email addresses, plus names, phone numbers and postal addresses. Carhartt confirmation remains unlocated. Check HIBP and verify unexpected messages independently.","summary":"ShinyHunters published data attributed to clothing retailer Carhartt in August 2026 following an extortion demand. Have I Been Pwned lists email addresses, names, phone numbers and physical addresses among the exposed information. Its founder, Troy Hunt, reduced an initial count of nearly 25 million email addresses to 12,933,413 after excluding synthetic test records and other invalid or duplicate entries. His analysis supported Carhartt as the source, but this remains separate from company confirmation. BleepingComputer reported on 27 August that Carhartt had not confirmed the breach or issued a statement. No later company confirmation, customer-notification announcement or remediation statement was found in the search through 3 November. The data publication and extortion are documented; subsequent misuse of the personal information is unknown. There is no customer software update associated with this incident.","action":"Check your email address on Have I Been Pwned. Verify unexpected shopping, delivery or breach messages by opening Carhartt’s website yourself; do not provide passwords, verification codes or payment details in response to unsolicited messages.","product":"Carhartt customer and contact data","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["carhartt","data-breach","shinyhunters","extortion","retail"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"Carhartt Data Breach","url":"https://haveibeenpwned.com/Breach/Carhartt","by":"Have I Been Pwned","date":"2026-08-25"},{"kind":"research","title":"A Cautionary Tale About Data Breach Claims, Verification and Carhartt","url":"https://www.troyhunt.com/a-cautionary-tale-about-data-breach-claims-verification-and-carhartt/","by":"Troy Hunt","date":"2026-08-26"},{"kind":"news","title":"Carhartt data breach affects 12.9M, half of what ShinyHunters claimed","url":"https://www.theregister.com/security/2026/08/26/carhartt-data-breach-affects-129m-half-of-what-shinyhunters-claimed/5292626","by":"The Register","date":"2026-08-26"},{"kind":"news","title":"Carhartt data breach exposes information of 12.9 million accounts","url":"https://www.bleepingcomputer.com/news/security/carhartt-data-breach-exposes-information-of-129-million-accounts/","by":"BleepingComputer","date":"2026-08-27"}],"started":"2026-08-13","closed":"2026-08-27","created":"2026-11-03T20:03:49.947Z","updated":"2026-11-03T20:03:49.947Z","cve_notes":[],"timeline":[{"at":"2026-08-27","added":"2026-11-03T20:02:18.575Z","kind":"other","text":"BleepingComputer reported that Carhartt had not confirmed the claims or issued a breach statement. A company spokesperson was unavailable when the publication sought comment.","url":"https://www.bleepingcomputer.com/news/security/carhartt-data-breach-exposes-information-of-129-million-accounts/","by":"BleepingComputer","patch":null},{"at":"2026-08-26","added":"2026-11-03T20:02:18.575Z","kind":"other","text":"Troy Hunt published his analysis: an initial 24,876,077 email addresses became 12,933,413 after removing synthetic records and other invalid or duplicate entries. He supported the Carhartt attribution with internal data markers and email aliases used specifically for Carhartt.","url":"https://www.troyhunt.com/a-cautionary-tale-about-data-breach-claims-verification-and-carhartt/","by":"Troy Hunt","patch":null},{"at":"2026-08-25","added":"2026-11-03T20:02:18.575Z","kind":"other","text":"Have I Been Pwned added the Carhartt incident, listing email addresses, names, phone numbers and physical addresses. Millions of synthetic records were excluded.","url":"https://haveibeenpwned.com/Breach/Carhartt","by":"Have I Been Pwned","patch":null},{"at":"2026-08-13","added":"2026-11-03T20:02:18.575Z","kind":"disclosed","text":"ShinyHunters published an archive attributed to Carhartt, claiming it contained more than 50GB of data. The Register reported that publication followed a $3.3 million extortion demand.","url":"https://www.theregister.com/security/2026/08/26/carhartt-data-breach-affects-129m-half-of-what-shinyhunters-claimed/5292626","by":"The Register","patch":"na"}],"url":"https://hard.fyi/live/carhartt-customer-data-published-aug-2026/","json":"https://hard.fyi/api/live?id=carhartt-customer-data-published-aug-2026"}