Carhartt Data Breach Exposes 12.9 Million Records, Far Below Initial Claims

Analysis Reveals Data Inflation in Hacker Claims

A cybersecurity investigation revealed that a data breach affecting Carhartt impacted approximately 12.9 million individuals, significantly less than the 25.8 million records initially claimed by the hacking group ShinyHunters. The findings emerged after a detailed analysis conducted by one artificial intelligence system and two human cybersecurity experts who examined the leaked data sets. The breach was reported in late August 2026, with the compromised information including names, email addresses, phone numbers, and hashed passwords associated with Carhartt customer accounts. The investigation aimed to verify the accuracy of the hackers’ public disclosures and assess the true scale of the exposure.

The research team discovered that the leaked data contained significant duplication and irrelevant entries, which inflated the initial count presented by ShinyHunters. By filtering out redundant records and validating the authenticity of each entry, the analysts determined that the actual number of unique, affected individuals was roughly half of what was originally asserted. The AI tool assisted in identifying patterns of repetition across the data dump, while the human experts focused on verifying the legitimacy of the personal information and cross-referencing it with known data formats used by Carhartt. This careful validation process highlighted how threat actors sometimes exaggerate breach sizes to amplify reputational damage or extortion leverage.

Why Did the Numbers Differ So Sharply?

The discrepancy between the claimed and verified figures stems from how the data was compiled and presented by the attackers. ShinyHunters had released a large data file that included test entries, outdated records, and information scraped from public sources, all of which were mixed with genuine customer data. The investigation showed that while the core breach was real and substantial, the amplification of numbers served to increase pressure on the company during negotiations. Cybersecurity analysts noted that such tactics are increasingly common in ransomware and data leak campaigns, where perception can be as damaging as the actual breach itself.

What type of information was exposed in the Carhartt breach? The exposed data included customer names, email addresses, phone numbers, and hashed passwords. No financial details or Social Security numbers were found in the verified leak.

Frequently Asked Questions

How did researchers confirm the actual number of affected individuals? Researchers used AI-assisted deduplication and manual validation to remove duplicate, fake, or irrelevant entries from the leaked data, isolating the genuine customer records.

Does this mean Carhartt customers are at less risk? While the number of affected individuals is lower than claimed, the breach still poses risks such as phishing and account takeover, especially if passwords were reused elsewhere.