Carhartt

Summary

Carhartt was targeted by the extortion group ShinyHunters, which claimed to have exfiltrated over 50 gigabytes of data from the company's Databricks analytics platform, affecting approximately 12.9 million accounts. The leaked data reportedly contained names, email addresses, phone numbers, physical addresses, and included more than 15,000 employee records with corporate email addresses. ShinyHunters published the archive on the dark web after an unsuccessful ransom demand, and the breach was later correlated with the exposed information by the Have I Been Pwned service.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On or about August 13, 2026, the extortion group ShinyHunters claimed to have stolen more than 50 gigabytes of documents containing personal customer and employee data from Carhartt. Carhartt has not publicly acknowledged the claim. Reports indicate that the breach affected over 12.9 million Carhartt accounts. The exposed information reportedly includes names, email addresses, phone numbers, and physical addresses. Analysis of the leaked data by the founder of Have I Been Pwned identified over 15,000 email addresses using the @carhartt.com domain, indicating employee information was also compromised. ShinyHunters stated they released the archive on the dark web after failing to persuade Carhartt to meet a $3.3 million ransom demand. The Have I Been Pwned founder linked the breach to a compromise of Carhartt's Databricks analytics platform, noting that the data set contained unique email addresses, names, phone numbers, physical addresses, and millions of synthetic records that were excluded from the breach count.

In response to the alleged breach, the national class action law firm Edelson Lechtzin LLP announced an investigation into data privacy claims arising from the Carhartt incident. The firm is offering free case evaluations to individuals who may have been affected. It is evaluating potential claims and legal remedies on behalf of those whose sensitive personal data may have been compromised. Edelson Lechtzin LLP will assess rights and possible claims at no cost to the individuals. The firm provided contact information for inquiries, including an address in Newtown, Pennsylvania, a telephone number, and an email address. A Carhartt spokesperson was not immediately available for comment when approached by media outlets seeking confirmation of the incident.

The incident has raised concerns about increased risk of identity theft and fraud for individuals who received a data breach notification from Carhartt. ShinyHunters described the stolen data as encompassing a wide range of customer, employee, and corporate information, including royalty metadata and other internal data. The group has previously claimed responsibility for breaches at numerous other organizations, including technology companies, retailers, and service providers. No further details about containment, remediation, or official statements from Carhartt have been provided in the available sources.

Sources

Sources available to members: 3 sources.