On 25 August 2026, 12.9 million email addresses attributed to the American workwear brand Carhartt were loaded into Have I Been Pwned. The service lists four categories of exposed data for the incident: email addresses, names, phone numbers and physical addresses. The records came from a dump published by the extortion group ShinyHunters, which described the breach as a pay or leak campaign.
The number is the part worth slowing down for. When the files first circulated they looked like roughly 25 million people. The figure that ended up in Have I Been Pwned is 12,933,413, and the gap is not a rounding error or a correction issued by Carhartt. Close to half the dump was synthetic data that was never about real customers at all, and it had been sitting inside the stolen files from the moment they were taken.
Carhartt itself has said nothing. At the time of writing the company has not confirmed the incident, has not published a statement, and did not respond to requests for comment from The Register or BleepingComputer. That absence shapes everything below. What follows comes from the criminals' own dump, from the technical analysis of it, and from the security press reporting on both.
What happened, and when
ShinyHunters claimed the breach on 13 August 2026, saying it held more than 50 GB of compressed data covering customer, employee and corporate records, and attaching an extortion demand of $3.3 million. BleepingComputer reported ShinyHunters' account of the negotiation, in which a company-side negotiator broke off talks without paying. That account comes from the extortion group, not from Carhartt, and nobody has confirmed it independently. The data was then published. The dump itself carries a timestamp of 1 August 2026, which is the closest thing available to a date for when the material was actually pulled.
Troy Hunt, who runs Have I Been Pwned, traced the origin to Carhartt's customer analytics warehouse running on Databricks. The file paths preserved inside the archive point at a Databricks table export rather than a live storefront database. The dataset also contained 15,057 addresses on the carhartt.com domain along with internal routing aliases, which is one of the signals that ties the material to the company's own systems rather than to a scraped or assembled list.
Hunt published his analysis on 25 August, the same day the addresses went into Have I Been Pwned, and the security press picked it up the following day. There has been no regulator filing, no customer notification letter and no company timeline for when access began, when it was noticed, or when it ended. Those gaps are not proof that the incident is smaller than reported. They simply mean nobody outside the company can currently answer those questions.
What leaked, and what nobody has mentioned
Have I Been Pwned lists the exposed categories for the genuine records as:
- Email addresses
- Names
- Phone numbers
- Physical addresses
The synthetic half is the more unusual story. Hunt found that roughly 45 percent of the dataset was TPC-DS benchmark data, a standard sample dataset used for testing analytics systems, which was sitting in the same schema as the real customer tables. His reading is that this is a genuine Carhartt Databricks breach and that the attackers, along with every aggregator who passed the file along afterwards, took the sample rows without recognising what they were. The tells were statistical rather than obvious: 97.6 percent of the email domains appeared exactly once, some of them plain gibberish, birth years were spread evenly across 1924 to 1992 with none of the clustering real populations show, and birth countries were distributed uniformly across all 211 ISO country codes. Stripping the benchmark rows brought the count to 13.3 million. Removing Microsoft routing aliases, further test rows and deactivated accounts brought it to the final 12,933,413 that Hunt published, roughly half the 24,876,077 addresses the raw files first yielded.
Two categories deserve care. Neither Have I Been Pwned's data classes nor the reporting mentions passwords, and neither mentions payment card details. Unmentioned is not the same as confirmed absent. Dates of birth appear in the dump, but they belong to the benchmark schema rather than to the verified customer records, which is exactly the kind of detail that gets flattened when a leak is summarised secondhand. Without a statement from Carhartt there is no authoritative inventory of what was taken, so the honest position is that four categories are documented and everything else is unknown.
Hunt's summary of the exercise was blunt: "you can't always take criminals at their word".
Whether you are affected
If you have ever bought from Carhartt online or held an account with the brand, your address may be in the set. The practical check is a search on Have I Been Pwned, which has carried the breach since 25 August and will have notified anyone already subscribed to its alerts. If the result comes back positive, our guide on reading a Have I Been Pwned result covers what the entry does and does not tell you, including why a hit is a prompt to check things rather than evidence that anything has been done with your data.
One figure changes how you should read a hit. Hunt reported that 83 percent of the addresses in the Carhartt set were already in Have I Been Pwned from earlier incidents. For most people this will not be the first appearance, and the address is likely already circulating in aggregated lists. That makes attribution harder rather than easier, and if you are trying to work out where a particular flood of mail started, tracing which company leaked your address is a separate exercise from confirming you appear in a given dump.
The checklist
Nothing here is specific to Carhartt. It is the same short list that applies whenever a name, address and phone number surface together, and our fuller walkthrough on what to do when your email leaks goes through it in order.
- Assume the address, name, phone number and postal address now travel as a package. Anyone contacting you can already recite all four, so knowing your details proves nothing about who they are.
- Expect the phone number to be used. A leak with names and numbers attached tends to be followed by calls and messages that reference a real order or a real brand.
- Treat any message about this breach as suspicious by default, particularly one offering compensation, a refund or a checking service. There has been no company notification, so an email claiming to be one is not matching anything real.
- Check whether the same address is your login somewhere important, and if it is, make sure that account has a unique password and a second factor.
- Do not change your everyday address in response. Rotating a single address you use everywhere just moves the problem, and the old one stays in circulation regardless.
- Give any new account you open a distinct address, so the next leak identifies its own source instead of adding to one undifferentiated pile.
The pattern it repeats
The first pattern is where the data lived. On Hunt's reading of the file paths, this was not the checkout database but an analytics copy of it, assembled so the business could ask questions about its customers. If that reading is right, it held enough to identify millions of people while sitting in a system whose job is reporting rather than transactions. Carhartt has confirmed nothing, so that remains an outside inference rather than a company account. Warehouses accumulate exports, and the mixture of real records with leftover test data in the same schema is a good illustration of how little anyone was watching what shared that space.
The second is the sequencing. The criminals published a number, the number was wrong by roughly a factor of two, and the correction came from an independent analyst rather than from the company. Anyone reading the first headlines had a figure that has since halved. That is worth remembering the next time a breach is described in the tens of millions on day one, and it is a reason to wait for verification before deciding how alarmed to be.
The third is the one that outlasts the story. The address is the join key. It is what let an analytics table be matched against everything else already circulating, and it is why 83 percent of these records could be linked to prior breaches within a day. Recycled address lists are also the raw material for the sextortion campaigns that recycle old ShinyHunters leaks, which is how a shopping account from years ago turns into a threatening email today. The address you gave a workwear shop was never meant to be an identifier across the whole internet. It became one because you only had one to give.