Carhartt data breach: what happened and what to do

What happened

Carhartt is a US workwear maker. In August 2026 the ShinyHunters group ran a "pay or leak" extortion campaign against it. BleepingComputer and other outlets reported that the group demanded a ransom, and published the data on August 13 when talks stalled.

Troy Hunt, who runs Have I Been Pwned, analysed the dump and linked it to the compromise of Carhartt's analytics platform. Carhartt had not publicly commented on the breach when these reports ran.

How many people

The group claimed about 50 million records. Have I Been Pwned counted 12,933,413 unique email addresses, about 12.9 million. The gap exists because the leak contained millions of synthetic records, entries invented to inflate the apparent size. They included odd email addresses, customers in countries with no real link to the brand, and birth dates in the early 1900s. Have I Been Pwned excluded them, so its figure covers real people.

What was exposed

Have I Been Pwned lists email addresses, names, phone numbers and physical addresses. Its report also noted more than 15,000 employee addresses in the leaked data. There are no passwords or payment cards in the listed data classes.

What that lets criminals do

A name, home address, phone number and email address is a standard toolkit for phishing and for text scams. A message that says it is from Carhartt about an order, a refund or an account problem will look right to someone who has bought from the brand.

The address and phone number also help a scammer pass as someone who knows you. Calls claiming to be from your bank or a delivery firm are more believable when the caller reads out your correct address.

Who is most exposed

People who bought online or created an account are the most likely to be in the data. Workwear is often bought for a job, so some people used a work email address, and a scammer who knows your employer can build a more believable message. The leak also held more than 15,000 employee addresses, so staff should expect messages that pose as HR or IT.

The company's response

Carhartt had not published a notice at the time of the reports. If it contacts you, treat that notice as the source on what was taken and any steps offered, and reach the company through its official website.

Why the fake records matter

The dump is a good example of why a headline number can mislead. The attackers' claim was four times larger than the verified count. For you, the question is simpler: is your email in the real data? Search your email on Have I Been Pwned and act on the data types listed above.