Carhartt data breach exposes 12.9 million accounts, ShinyHunters group claims

Extortion group publishes stolen data; Have I Been Pwned adds records to database

edit

By LineZotpaper

Published27 August 2026

Read Time2 min

The ShinyHunters extortion group has publicly released sensitive data belonging to nearly 12.9 million Carhartt customer accounts, according to data breach notification service Have I Been Pwned. The breach, which occurred earlier this month, exposes names, email addresses, and potentially other personal information, raising concerns about credential theft and targeted phishing attacks against the popular clothing retailer's customers.

The ShinyHunters extortion group has published a trove of data allegedly stolen from Carhartt, the American clothing manufacturer known for its rugged workwear. The leaked data includes information on approximately 12.9 million accounts, according to Have I Been Pwned (HIBP), a service that tracks data breaches and notifies users when their credentials are compromised.

Carhartt has not yet publicly commented on the breach. The company operates a substantial e-commerce and retail presence, serving both individual consumers and industrial clients. The compromised data is believed to include account email addresses, names, and possibly hashed passwords, though the exact scope and sensitivity of the exposed fields have not been confirmed by the company.

The ShinyHunters group is a known cybercriminal gang that has previously claimed responsibility for major breaches at companies such as Microsoft (a limited source code leak), AT&T, and Pixlr. The group often sells or publicly releases stolen databases as a means of extortion or reputation damage. In this case, the data was made available for free on underground forums, increasing the risk of misuse.

Have I Been Pwned founder Troy Hunt confirmed that the records have been ingested into the service, allowing affected users to check if their email addresses are part of the breach. Hunt noted that while the dataset appears legitimate, independent verification is ongoing.

For Carhartt customers, the immediate risks include phishing emails crafted using the exposed information, as well as credential stuffing attacks—where cybercriminals attempt to use the same email-password combination on other online services. Users are advised to change their Carhartt account password immediately, enable multi-factor authentication if available, and remain vigilant for suspicious communications.

This incident underscores the persistent threat that data breaches pose to major retailers, which hold vast amounts of customer information. Carhartt joins a growing list of companies that have been targeted by groups like ShinyHunters, highlighting the need for robust data security practices and rapid incident response.

Analysis

Why This Matters

Affected customers risk phishing attacks and identity theft if full personal details (e.g., addresses, phone numbers) were exposed alongside email addresses.
The breach reinforces the vulnerability of retail customer databases, with potential for credential stuffing across other platforms.
Carhartt's reputation and trust among its loyal customer base may be damaged if the company is perceived as having weak security.

Background

Carhartt, founded in 1889, is a major American workwear brand with a strong online sales channel. Data breaches at retailers are common—previous high-profile incidents include Target (2013) and Home Depot (2014). The ShinyHunters group emerged around 2020 and has been linked to dozens of breaches, often targeting tech and retail companies. They typically demand a ransom or sell data; releasing it for free is a tactic to maximize pressure on the victim organization. Have I Been Pwned has tracked this breach since the data appeared on forums earlier this week.

Key Perspectives

Carhartt Customers: Users want clear communication from Carhartt about what data was taken, whether passwords were hashed, and what steps the company is taking to prevent future breaches. They also need guidance on protecting themselves. Carhartt (Company): As of publication, Carhartt has not issued a statement. The company likely faces a costly response including customer notifications, credit monitoring offers, and potential regulatory fines under laws like the GDPR or state data breach notification laws. Cybersecurity Researchers: Experts note the importance of using unique passwords and enabling multi-factor authentication. They also criticize the slow pace of public disclosure and call for better third-party security audits at large retailers.

What to Watch

Official confirmation and statement from Carhartt, including the specific types of data exposed and whether payment information was compromised.
Whether the leaked data leads to a spike in credential stuffing attacks, as tracked by cybersecurity firms.
Potential class-action lawsuits or regulatory investigations if Carhartt is found to have been negligent in protecting customer data.

Sources

Carhartt data breach exposes information of 12.9 million accounts — BleepingComputer