Breach analysis · 7 min read

The Carhartt Breach and the Inflated Number

Twelve point nine million addresses, roughly half the figure first claimed, and a company that has still not said anything publicly.

YeyMail Team ·

On 25 August 2026, 12.9 million email addresses attributed to the American workwear brand Carhartt were loaded into Have I Been Pwned. The service lists four categories of exposed data for the incident: email addresses, names, phone numbers and physical addresses. The records came from a dump published by the extortion group ShinyHunters, which described the breach as a pay or leak campaign.

The number is the part worth slowing down for. When the files first circulated they looked like roughly 25 million people. The figure that ended up in Have I Been Pwned is 12,933,413, and the gap is not a rounding error or a correction issued by Carhartt. Close to half the dump was synthetic data that was never about real customers at all, and it had been sitting inside the stolen files from the moment they were taken.

Carhartt itself has said nothing. At the time of writing the company has not confirmed the incident, has not published a statement, and did not respond to requests for comment from The Register or BleepingComputer. That absence shapes everything below. What follows comes from the criminals' own dump, from the technical analysis of it, and from the security press reporting on both.

What happened, and when

ShinyHunters claimed the breach on 13 August 2026, saying it held more than 50 GB of compressed data covering customer, employee and corporate records, and attaching an extortion demand of $3.3 million. BleepingComputer reported ShinyHunters' account of the negotiation, in which a company-side negotiator broke off talks without paying. That account comes from the extortion group, not from Carhartt, and nobody has confirmed it independently. The data was then published. The dump itself carries a timestamp of 1 August 2026, which is the closest thing available to a date for when the material was actually pulled.

Troy Hunt, who runs Have I Been Pwned, traced the origin to Carhartt's customer analytics warehouse running on Databricks. The file paths preserved inside the archive point at a Databricks table export rather than a live storefront database. The dataset also contained 15,057 addresses on the carhartt.com domain along with internal routing aliases, which is one of the signals that ties the material to the company's own systems rather than to a scraped or assembled list.

Hunt published his analysis on 25 August, the same day the addresses went into Have I Been Pwned, and the security press picked it up the following day. There has been no regulator filing, no customer notification letter and no company timeline for when access began, when it was noticed, or when it ended. Those gaps are not proof that the incident is smaller than reported. They simply mean nobody outside the company can currently answer those questions.

What leaked, and what nobody has mentioned

Have I Been Pwned lists the exposed categories for the genuine records as:

  • Email addresses
  • Names
  • Phone numbers
  • Physical addresses

The synthetic half is the more unusual story. Hunt found that roughly 45 percent of the dataset was TPC-DS benchmark data, a standard sample dataset used for testing analytics systems, which was sitting in the same schema as the real customer tables. His reading is that this is a genuine Carhartt Databricks breach and that the attackers, along with every aggregator who passed the file along afterwards, took the sample rows without recognising what they were. The tells were statistical rather than obvious: 97.6 percent of the email domains appeared exactly once, some of them plain gibberish, birth years were spread evenly across 1924 to 1992 with none of the clustering real populations show, and birth countries were distributed uniformly across all 211 ISO country codes. Stripping the benchmark rows brought the count to 13.3 million. Removing Microsoft routing aliases, further test rows and deactivated accounts brought it to the final 12,933,413 that Hunt published, roughly half the 24,876,077 addresses the raw files first yielded.

Two categories deserve care. Neither Have I Been Pwned's data classes nor the reporting mentions passwords, and neither mentions payment card details. Unmentioned is not the same as confirmed absent. Dates of birth appear in the dump, but they belong to the benchmark schema rather than to the verified customer records, which is exactly the kind of detail that gets flattened when a leak is summarised secondhand. Without a statement from Carhartt there is no authoritative inventory of what was taken, so the honest position is that four categories are documented and everything else is unknown.

Hunt's summary of the exercise was blunt: "you can't always take criminals at their word".

Whether you are affected

If you have ever bought from Carhartt online or held an account with the brand, your address may be in the set. The practical check is a search on Have I Been Pwned, which has carried the breach since 25 August and will have notified anyone already subscribed to its alerts. If the result comes back positive, our guide on reading a Have I Been Pwned result covers what the entry does and does not tell you, including why a hit is a prompt to check things rather than evidence that anything has been done with your data.

One figure changes how you should read a hit. Hunt reported that 83 percent of the addresses in the Carhartt set were already in Have I Been Pwned from earlier incidents. For most people this will not be the first appearance, and the address is likely already circulating in aggregated lists. That makes attribution harder rather than easier, and if you are trying to work out where a particular flood of mail started, tracing which company leaked your address is a separate exercise from confirming you appear in a given dump.

The checklist

Nothing here is specific to Carhartt. It is the same short list that applies whenever a name, address and phone number surface together, and our fuller walkthrough on what to do when your email leaks goes through it in order.

  • Assume the address, name, phone number and postal address now travel as a package. Anyone contacting you can already recite all four, so knowing your details proves nothing about who they are.
  • Expect the phone number to be used. A leak with names and numbers attached tends to be followed by calls and messages that reference a real order or a real brand.
  • Treat any message about this breach as suspicious by default, particularly one offering compensation, a refund or a checking service. There has been no company notification, so an email claiming to be one is not matching anything real.
  • Check whether the same address is your login somewhere important, and if it is, make sure that account has a unique password and a second factor.
  • Do not change your everyday address in response. Rotating a single address you use everywhere just moves the problem, and the old one stays in circulation regardless.
  • Give any new account you open a distinct address, so the next leak identifies its own source instead of adding to one undifferentiated pile.

The pattern it repeats

The first pattern is where the data lived. On Hunt's reading of the file paths, this was not the checkout database but an analytics copy of it, assembled so the business could ask questions about its customers. If that reading is right, it held enough to identify millions of people while sitting in a system whose job is reporting rather than transactions. Carhartt has confirmed nothing, so that remains an outside inference rather than a company account. Warehouses accumulate exports, and the mixture of real records with leftover test data in the same schema is a good illustration of how little anyone was watching what shared that space.

The second is the sequencing. The criminals published a number, the number was wrong by roughly a factor of two, and the correction came from an independent analyst rather than from the company. Anyone reading the first headlines had a figure that has since halved. That is worth remembering the next time a breach is described in the tens of millions on day one, and it is a reason to wait for verification before deciding how alarmed to be.

The third is the one that outlasts the story. The address is the join key. It is what let an analytics table be matched against everything else already circulating, and it is why 83 percent of these records could be linked to prior breaches within a day. Recycled address lists are also the raw material for the sextortion campaigns that recycle old ShinyHunters leaks, which is how a shopping account from years ago turns into a threatening email today. The address you gave a workwear shop was never meant to be an identifier across the whole internet. It became one because you only had one to give.

The YeyMail takeaway
Give every shop its own address

A leak like this is only useful to whoever holds it because the same address appears in a hundred other datasets. YeyMail lets you hand a different address to each site, so a warehouse export that reaches the wrong hands identifies one shop and nothing else. If an address starts attracting mail you did not ask for, the kill switch refuses new mail at SMTP time, so the sender gets a rejection rather than the message being quietly accepted and dropped. It is never paywalled and keeps working after you cancel. There is a free 7-day trial with no card, and paid plans start at $0.99 a month. Aliases are truly unlimited only on domains you own; on the shared yeymail.com domain the caps are 500 on Starter and 5,000 on Plus, counting every address ever created there including deleted ones. None of this undoes an existing leak, and nothing here is legal advice.

Start free — one alias per signup7-day trial · No credit card

Sources

Common questions

How many people were actually affected?

Have I Been Pwned lists 12,933,413 unique email addresses, added on 25 August 2026. ShinyHunters had presented a figure around twice that size. The difference is accounted for by synthetic benchmark records that were mixed in with the real data, not by any correction from Carhartt.

Has Carhartt confirmed the breach?

Not as of the time of writing. The company has not issued a public statement, has not published a timeline, and did not respond to requests for comment from The Register or BleepingComputer. All the detail currently available comes from the published dump and from independent analysis of it.

Were passwords or card details included?

Neither Have I Been Pwned's list of exposed categories nor the reporting mentions passwords or payment card data. That means those categories are unmentioned, which is different from being confirmed safe. Without a statement from the company there is no complete inventory of what was taken.

Why was so much of the leaked data fake?

The stolen material came from an analytics warehouse where a standard sample dataset used for benchmarking sat in the same schema as real customer tables. The attackers exported everything without distinguishing between the two. Around 45 percent of the rows turned out to be that sample data.

My address shows up, but I do not remember shopping there. What now?

About 83 percent of the addresses in this set had already appeared in earlier breaches, so a hit does not prove where any given piece of unwanted mail originated. Treat it as a prompt to check that the address is not reused as a login with a weak password, and expect that your name, phone number and postal address may travel alongside it.

Should I change my email address because of this?

Changing the single address you use everywhere rarely helps, because the leaked copy stays in circulation and you have to update every account you own. The more useful change is to stop giving the same address to every service, so a future leak points at one company rather than merging with everything else.

Keep reading

Scam watch
Sextortion Scammers Are Recycling the ShinyHunters Leaks
Breach response
Your Email Was Leaked: The Complete What-Now Checklist
Privacy guide
How to Find Out Which Company Leaked Your Email