Carhartt Leak Verifies at 12.9 Million — Half the Claim, Padded With Synthetic Records

On 13 August 2026 ShinyHunters published what it described as 50GB of Carhartt customer data, after the clothing company declined to meet a $3.3 million demand. On 26 August, Have I Been Pwned added the breach at 12.9 million unique accounts — email addresses, names, phone numbers and physical addresses — roughly half what the group had claimed. Troy Hunt’s analysis found the published set injected with millions of lines of synthetic data, padding the apparent total, and linked the underlying theft to the compromise of Carhartt’s Databricks analytics environment.

The corpus has recorded inflated claims throughout — reach counted as theft, rows counted as people, 26-0425’s ten million against five and a half. Fabricating records and mixing them into genuine data is a different act. A claim can be discounted; a poisoned dataset has to be cleaned before it can even be counted, and every downstream consumer — notification lists, class definitions, breach databases — inherits the problem.

It also cuts against the attacker’s own interest in a way worth noting: a leak that fails verification once makes that group’s every future claim cheaper to doubt. Reputation is the asset these operations trade on, and this spends it.

The reported source is the company’s Databricks environment — customer data pooled for analysis, outside the transactional systems that usually get the security attention. The 2025 SaaS-platform wave filed at 25-0810 ran on the same structure: the copy of the data that exists for querying is the copy that leaves.

No payment data, no credentials, no identifiers that unlock accounts — by field list, among the mildest categories filed here. The realistic harm is phishing that quotes a real purchase to a real address, at a scale where even a small hit rate pays. The company’s customers absorb that; the negotiation that failed was never about them.