The ShinyHunters extortion group has published a 50GB archive of data stolen from Carhartt, the American workwear retailer founded in 1889, exposing information from nearly 12.9 million customer and employee accounts. The group initially demanded a $3.3 million ransom, which Carhartt refused to pay — leading ShinyHunters to release the data freely on their dark web site. Have I Been Pwned (HIBP) founder Troy Hunt reviewed the archive and linked the breach to a compromise of Carhartt’s Databricks analytics platform, a cloud-based data platform the company uses for reporting and data storage.
The leaked data includes employee and customer records, personal identifiable information, and customer metadata including loyalty program details. ShinyHunters also found over 15,000 employee email addresses with the @carhartt.com domain in the dataset. The breach appears to have occurred earlier in August, and Carhartt has not yet made a public statement about the incident. ShinyHunters is the same group behind breaches at AT&T, Ticketmaster, and dozens of other companies — and the Databricks platform has been a recurring attack target, with the platform’s stolen credentials enabling access to multiple organizations’ data warehouses.
How to check if you’re affected
Affected products include any Carhartt online account used for purchases, loyalty programs, or employee access before late August 2026. If you have a Carhartt account, check whether your email address appears in the breach at haveibeenpwned.com. Change your Carhartt password immediately and use a unique password for each account. Be alert for phishing emails referencing your Carhartt purchases or loyalty points — attackers with access to this data may use it to craft convincing lures.