Data-breach notification service Have I Been Pwned analysed the archive released by the ShinyHunters extortion group and placed it at 12.9 million Carhartt accounts, with unique email addresses, names, phone numbers and physical addresses exposed, plus more than 15,000 employees with @carhartt.com addresses. Troy Hunt linked the dataset to a compromise of Carhartt's Databricks analytics platform and excluded millions of synthetic records that did not relate to real individuals. Carhartt has not confirmed the breach or issued a statement; ShinyHunters claimed the attack on 13 August, demanded a US$3.3 million ransom, and published the roughly 50 GB archive after the company declined to negotiate.

Source

• BleepingComputer
• Captured via /raw/digests/Cyber-Digest-2026-08-28.md