ShinyHunters dumps 12.9 million Carhartt customer records after ransom refusal
The extortion crew says it grabbed 50GB from the workwear brand's Databricks cloud analytics platform. Carhartt walked away from a $3.3 million demand, and the data is now public.
Key points
- ShinyHunters published data on 12.9 million Carhartt accounts after the retailer refused a $3.3 million ransom demand made in August 2026.
- The stolen archive weighs about 50GB and includes names, email addresses, physical addresses and phone numbers.
- Have I Been Pwned founder Troy Hunt traced the theft to Carhartt's Databricks cloud analytics platform.
- More than 15,000 staff email addresses ending in @carhartt.com also appeared in the leak.
- ShinyHunters has been tied this year to breaches at Google, Cisco, the European Commission and dozens of Snowflake customers.
The extortion group ShinyHunters has dumped a cache of stolen data from the American workwear brand Carhartt, first reported by BleepingComputer. Around 12.9 million customer accounts are in the file.
Carhartt, which has made rugged clothing since 1889 and employs more than 3,000 people across the US and Europe, refused to pay. The criminals published everything.
What was actually stolen?
Roughly 50GB of files: names, email addresses, physical addresses and phone numbers for nearly 13 million customers, plus employee records and internal corporate documents.
Troy Hunt, who runs the breach-notification site Have I Been Pwned, went through the archive and loaded 12.9 million affected accounts into his service. He found more than 15,000 email addresses ending in @carhartt.com, suggesting most of the company's staff directory is in the dump. He also stripped out what he described as "millions of synthetic records" (fake test data) before loading the real ones.
How did the attackers get in?
Hunt linked the theft to Carhartt's Databricks setup. Databricks is a cloud service where companies centralise customer data for analytics and reporting, essentially one large filing cabinet in the cloud.
If that cabinet is reachable with stolen or weak login credentials, an attacker can walk out with the lot in a single session. It's not a novel attack. It's the same pattern seen across dozens of Snowflake customers over the past year: a cloud data warehouse, valid credentials, no additional verification. We've been covering ShinyHunters across 21 stories in the past 90 days, and that pattern hasn't changed once.
Carhartt hasn't publicly confirmed the breach or explained how the account was accessed.
What happened with the ransom?
ShinyHunters claimed the attack on 13 August 2026 and demanded $3.3 million. Carhartt said no.
According to chat logs the group posted, a company negotiator told them: "After careful review and internal discussions with leadership, we have decided not to move forward with negotiations or further discussions." The data went up on the group's dark web leak site shortly after.
| Detail | Figure |
|---|---|
| Accounts exposed | 12.9 million |
| Staff emails in dump | 15,000+ |
| Archive size | ~50GB |
| Ransom demanded | $3.3 million |
| Attack claimed | 13 August 2026 |
Should Carhartt customers worry?
Yes, though the risk is mostly scams rather than direct financial theft. Payment card numbers haven't been reported as part of the leak. Contact details have.
Anyone who bought from Carhartt should expect phishing emails (fake messages designed to look like they come from the retailer) and text-message scams. Two practical steps: treat any "Carhartt order problem" email with suspicion and go to the website directly, then change your Carhartt password if you've reused it elsewhere.
You can check whether your email address is in this dump on Have I Been Pwned.
Who are ShinyHunters?
A data-theft and extortion crew that's had a relentless 2025. They've been linked to breaches at more than a dozen Snowflake customers, hundreds of Salesforce customer environments through the Salesforce Aura and Salesloft Drift campaigns, and most recently a wave of attacks exploiting a zero-day flaw (a bug the vendor hadn't yet discovered) in Oracle PeopleSoft.
Among organisations they've claimed to hit: Google, Cisco, the European Commission, Match Group, Vimeo, Rockstar Games, McGraw Hill, 7-Eleven, Carnival, Udemy and medical device maker Medtronic. Find a cloud platform holding customer data, get in with valid credentials, take everything, demand payment. That's the playbook, and nothing about Carhartt suggests it's changing.
