Data attributed to Carhartt published with 12.9 million email addresses
ShinyHunters published data attributed to Carhartt containing 12.9 million unique email addresses, plus names, phone numbers and postal addresses. Carhartt confirmation remains unlocated. Check HIBP and verify unexpected messages independently.
Check your email address on Have I Been Pwned. Verify unexpected shopping, delivery or breach messages by opening Carhartt’s website yourself; do not provide passwords, verification codes or payment details in response to unsolicited messages.
What’s happening
ShinyHunters published data attributed to clothing retailer Carhartt in August 2026 following an extortion demand. Have I Been Pwned lists email addresses, names, phone numbers and physical addresses among the exposed information. Its founder, Troy Hunt, reduced an initial count of nearly 25 million email addresses to 12,933,413 after excluding synthetic test records and other invalid or duplicate entries. His analysis supported Carhartt as the source, but this remains separate from company confirmation. BleepingComputer reported on 27 August that Carhartt had not confirmed the breach or issued a statement. No later company confirmation, customer-notification announcement or remediation statement was found in the search through 3 November. The data publication and extortion are documented; subsequent misuse of the personal information is unknown. There is no customer software update associated with this incident.
- What
- Breach
- Affects
- Carhartt customer and contact data
- Fixed in
- Nothing to patch
- Since
- 13 Aug 2026
- Closed
- 27 Aug 2026
Timeline
- Update
BleepingComputer reported that Carhartt had not confirmed the claims or issued a breach statement. A company spokesperson was unavailable when the publication sought comment.
- Update
Troy Hunt published his analysis: an initial 24,876,077 email addresses became 12,933,413 after removing synthetic records and other invalid or duplicate entries. He supported the Carhartt attribution with internal data markers and email aliases used specifically for Carhartt.
- Update
Have I Been Pwned added the Carhartt incident, listing email addresses, names, phone numbers and physical addresses. Millions of synthetic records were excluded.
- Made publicNothing to patch
ShinyHunters published an archive attributed to Carhartt, claiming it contained more than 50GB of data. The Register reported that publication followed a $3.3 million extortion demand.
Sources
- Carhartt Data BreachHave I Been Pwned · 25 Aug 2026
- A Cautionary Tale About Data Breach Claims, Verification and CarharttTroy Hunt · 26 Aug 2026
- Carhartt data breach affects 12.9M, half of what ShinyHunters claimedThe Register · 26 Aug 2026
- Carhartt data breach exposes information of 12.9 million accountsBleepingComputer · 27 Aug 2026