The extortion group ShinyHunters says it breached Carhartt, the workwear maker based in Dearborn, Michigan, and in August 2026 it published what it claims is roughly 50 gigabytes of the company's data. Have I Been Pwned's analysis of the leak found about 12.9 million unique email addresses, along with names, phone numbers and physical addresses, according to Morgan & Morgan. A federal class action filed in Michigan cites the same figure. Carhartt has not made a public statement about the incident. Its online newsroom, which has posted regularly through November 10, does not mention it, and no regulator filing or breach notification letter has been published. Most of what is known comes from court filings, lawyer marketing, breach-tracking services and dark web monitoring, so the details below should be read as reported rather than confirmed.
What Happened
The class action complaint, as summarised by Top Class Actions, says ShinyHunters announced on or around August 13, 2026 that it had compromised Carhartt's internal data systems and released about 50GB of data. InfoSources, which tracks the group, places Carhartt in a run of ShinyHunters attacks between late July and early September 2026. The other targets in that run were Brinks Home, RingCentral and a large North American medicine distributor. InfoSources reports that Carhartt, like RingCentral, refused to pay the extortion demand, and that customer details were dumped within days of the refusal. Neither company has confirmed this account of the negotiations.
The data has kept circulating. On October 17, the dark web monitoring service Darkwiser flagged a forum post by a user calling themselves "Blastoize" that claims to republish the August Carhartt dataset with a sample. Darkwiser lists the post as unverified. Blastoize appears to be redistributing the data. Nothing indicates a second breach.
The legal fallout is growing. Plaintiff Cole Sebastian filed Sebastian v. Carhartt, Inc. (No. 2:26-cv-13464) on September 11, 2026 in the U.S. District Court for the Eastern District of Michigan. Judge Laurie J. Michelson is assigned to the case. Legal tracker All About Lawyer reports that the claims include negligence, breach of implied contract and unjust enrichment, and that no class had been certified and no settlement reported as of October 5. Morgan & Morgan describes "multiple proposed mass arbitration claims" filed in federal court in September. Accounts differ on how many actions exist and what form they take, and only the Sebastian case has been identified by docket number. None of the allegations have been proven.
What Was Taken
The reports agree on the types of data exposed:
- Email addresses (about 12.9 million unique, per Have I Been Pwned as cited by Morgan & Morgan)
- Full names
- Phone numbers
- Physical or mailing addresses
Every account puts the number of affected people at 12.9 million, or "nearly 13 million" in the class action complaint. However, every one of those figures traces back to the leaked dataset itself, and Carhartt has not given its own count. InfoSources notes that during the same campaign, an independent audit found ShinyHunters had padded its headline numbers with synthetic records at another victim. No such audit of the Carhartt data has been reported, but the 12.9 million figure should be treated as an upper bound until the company confirms it.
None of the reports mention payment card data, passwords or government ID numbers. All About Lawyer suggests employee records could be involved, but no published analysis of the leak has confirmed that.
Why It Matters
Contact data alone can seem low-risk, but it is exactly what makes phishing believable. With a name, home address, phone number and proof of a past purchase from a well-known brand, a scammer can write convincing fake delivery notices, order problem emails, refund lures and text messages (smishing). Darkwiser rates the listing 78 out of 100 for severity and highlights phishing, smishing and account takeover attempts as the likely follow-on abuse. Because the data was republished in October, more criminals now have it, so the risk will last for months.
For defenders, this case continues a pattern ShinyHunters has followed all year. The group does not encrypt systems. It steals data and then extorts. Refusing to pay, which is what law enforcement advises, means the data is published, and lawsuits follow within weeks. The Carhartt suit was filed less than a month after the leak, and its central claim is that data was not properly encrypted, "even for internal use." Companies should expect that argument to come up quickly after any data theft.
The Attack Technique
Carhartt has not disclosed how the attackers got in. Two outside accounts point the same way:
- InfoSources reports that every company in ShinyHunters' summer campaign "was reached through a person, a credential or a vendor-hosted platform." None of them suffered ransomware encryption or system outages.
- A consumer security blog, go2g2, reports that the Carhartt records were taken from data stored in a cloud platform and published after extortion talks failed.
That matches ShinyHunters' known methods: voice phishing (vishing) of help desk and IT staff, abuse of stolen or reused credentials, and bulk export from third-party SaaS and cloud platforms such as CRM systems. Neither source names the specific platform or vendor involved at Carhartt, and the company has not confirmed either account. Until it does, the exact entry point is unknown.
What Organizations Should Do
- Lock down SaaS and cloud data exports. Check which accounts and connected apps can bulk-export customer records from CRM, marketing and e-commerce platforms. Revoke unused OAuth tokens and connected apps, and alert on large or unusual export jobs.
- Make help desk and IT staff phishing-resistant. ShinyHunters relies on phone-based social engineering. Require strong identity checks before password resets or MFA re-enrolment, and move administrators to FIDO2 or passkey-based MFA.
- Encrypt customer data at rest, including in internal systems. The Carhartt complaint centres on this point. Field-level encryption or tokenisation of contact data limits what a stolen export exposes.
- Prepare for data-theft extortion, not only ransomware. Decide in advance how you will respond to a leak-site deadline, including legal, regulator and customer notification, so that refusing to pay does not leave a gap in communication.
- Warn customers early and specifically. If contact data leaks, tell customers what real messages from you look like and which channels you will never use. Carhartt's silence leaves its customers relying on lawyers and blogs for this information.
- Watch for republication. Monitor dark web forums and breach notification services for your domain. The Carhartt data resurfaced two months after the first leak.
Sources: Carhartt Data Breach Claim: Can Customers Seek Compensation Without... | Carhartt hit with class action after ShinyHunters hack | Carhartt Data Breach Lawsuit, Were You Affected? | Carhartt Data Breach Claims: What Are the Claims Alleging About Cus... | Newsroom: News & Press Releases Carhartt | Carhartt Email Addresses and Contact Details Exposed on Dark Web Fo... | Refusal Has a Price List: ShinyHunters’ Summer Run from a Home-Alar... | Carhartt data breach exposed information: Protect Your PC in