The ShinyHunters extortion crew has published what it says is 50GB of data stolen from Carhartt, the 140-year-old Michigan workwear manufacturer, after the company refused to pay a $3.3 million ransom. The claim was first reported by Cybernews (S1) on August 13, 2026, and separately picked up by dark-web monitoring outfit ThreatMon, circulated via UNDERCODE NEWS (S7), the following morning. Both are OTHER-tier sources. As of publication there is no statement from Carhartt, no regulator filing, and no vendor advisory naming the company. Everything specific to Carhartt in this brief originates with the threat actor and should be read as an actor claim, not a confirmed breach. What is well established is the pattern: ShinyHunters has run an unbroken sequence of leak-site extortions through mid-2026 against Brinks Home, Exact Sciences, and others, and Microsoft has published PRIMARY research on the tradecraft behind them.
What Happened
According to Cybernews, ShinyHunters posted Carhartt to its dark-web leak site on Thursday, August 13, with a download link to an alleged 50GB archive of customer and employee records. The gang framed the leak as retaliation for a collapsed negotiation: it demanded $3.3 million, says Carhartt made contact but declined to bargain, and claimed it would have settled for less had the company's negotiators not been, in its words, "incompetent."
ShinyHunters published what it says is the final message from Carhartt: "After careful review and internal discussions with leadership, we have decided not to move forward with negotiations or further discussions. We appreciate your patience throughout this process." That text has not been authenticated by any outlet.
Accounts of timing differ slightly. Cybernews dates the leak-site post to Thursday, August 13. ThreatMon logged Carhartt as a newly added victim at 08:59:51 UTC+3 on August 14, per UNDERCODE NEWS, which also flagged a separate, unrelated listing of Vector Two Technology by The Gentlemen group minutes earlier. The gap is consistent with monitoring-feed lag rather than two distinct events, but neither report establishes when the intrusion itself occurred. UNDERCODE NEWS itself cautions that a leak-site appearance "does not automatically prove that an intrusion occurred."
One detail cuts against the actor's own story: Cybernews notes ShinyHunters attached no proof samples to the Carhartt entry. In its Brinks Home and Exact Sciences listings, the group volunteered row counts, object names, and field-level detail. The absence here is conspicuous.
What Was Taken
The only figure attached to Carhartt is 50GB, and only ShinyHunters has stated it. Cybernews describes the contents as customer and employee data and characterises the exposure as affecting "millions" of customers, a scale inferred from the archive size rather than from any enumerated record count. No source provides a victim tally, a field list, or a jurisdictional breakdown. Anyone quoting a Carhartt record count today is extrapolating.
For calibration, here is what ShinyHunters has actually delivered in comparable recent cases:
- Brinks Home: the group claimed more than 4.9 million stolen Salesforce records (BleepingComputer, SecurityWeek), including over 1.1 million rows from the Salesforce "Contacts" object and roughly 4,000 rows of employee PII covering full names, email addresses, job titles, and phone numbers. After no ransom was paid, it leaked more than 41GB of files. SecurityWeek explicitly states it did not independently verify the claims.
- Exact Sciences, the Abbott cancer diagnostics unit: the published dataset yielded 10.9 million unique email addresses once Have I Been Pwned ingested it, alongside names, physical addresses, phone numbers, dates of birth, genders, and personal health information belonging to customers, patients, and providers (The Register).
Note the ratio in the Brinks case: 41GB of files corresponded to a claimed 4.9 million records. If the Carhartt archive is real and structurally similar, 50GB is in the same order of magnitude, which makes "millions" plausible without making it confirmed. Retail loyalty and e-commerce data typically carries names, emails, phone numbers, shipping addresses, and order histories rather than payment card data, but until Carhartt or a regulator says otherwise, the field list is unknown.
Why It Matters
Carhartt is privately held and family-owned, generating close to $1 billion in annual revenue across roughly 70 US stores and about 100 further retail locations in Europe, Asia, and North America, per Cybernews. Private ownership matters here: there is no SEC Item 1.05 disclosure obligation of the kind that forces public companies to speak within four business days. The first authoritative confirmation, if it comes, will likely be a state attorney general notification filing rather than a press release. Chick-fil-A's unrelated credential-stuffing breach followed exactly that path, surfacing through Maine, Texas, and Massachusetts AG filings that pinned the total at 13,322 people (BleepingComputer).
The strategic read is about the extortion economics. ShinyHunters is publicly punishing non-payment and saying so explicitly, telling Abbott it "should've paid the ransom" and mocking Carhartt's negotiators. That messaging is aimed at the next victim's boardroom, not at the current one. Defenders should expect the group to keep leaking on schedule whenever a target walks, because the deterrent value of a published dump is the business model.
The second point is that none of these are encryption events. Abbott stressed its incident was "not an encryption malware event," and Brinks Home confirmed alarm monitoring and system functionality were unaffected. Data theft extortion bypasses every control tuned for ransomware detonation. If your incident response plan is built around restoring from backup, it does not apply.
The Attack Technique
No source states how Carhartt was breached. What can be established is the actor's repertoire, and here the PRIMARY sourcing is strong.
Microsoft's July 13, 2026 research documents campaigns observed between mid-2025 and mid-2026 with tradecraft overlapping ShinyHunters, targeting customer SaaS applications including Salesforce instances. Microsoft identifies two primary intrusion paths: voice phishing aimed at obtaining OAuth consent, and supply chain compromise through trusted workflows and integrations such as Salesloft and Gainsight. Both routes let the attacker inherit user and application privileges, enumerate and query CRM records, and exfiltrate at scale while evading conventional authentication detections, because the traffic rides a legitimate, already-consented OAuth relationship. Microsoft is unambiguous that this is not a Salesforce vulnerability; it is abuse of trusted authorisation. Microsoft observed the activity across many tenants in retail, education, and manufacturing.
The vishing path is corroborated at the victim level. ShinyHunters told BleepingComputer it breached Brinks Home on July 13, 2026 through a Microsoft Entra vishing attack, calling an employee and walking them through an Entra authentication or registration flow that handed the caller account access. Abbott independently confirmed that its Exact Sciences intrusion began with a vishing attack (The Register). Two victims, one technique, confirmed from both sides.
A retail brand with a large loyalty and e-commerce customer base fits the observed targeting profile exactly. That is a hypothesis about Carhartt, not a finding.
What Organizations Should Do
- Audit every OAuth-connected application in your SaaS tenants. Microsoft's guidance is direct: inventory connected apps, validate third-party integrations, and review their configurations. Revoke consented apps nobody can name an owner for. Integration platforms like Salesloft and Gainsight are named intrusion paths, not hypotheticals.
- Enable Salesforce event monitoring and wire it to your SIEM. Microsoft worked with Salesforce to improve telemetry granularity for Defender for Cloud Apps, adding near-real-time detection with connected-application attribution and expanded permission insight. Turn it on; the default posture will not catch a legitimate OAuth token pulling bulk queries.
- Harden the help desk and identity enrollment process against voice. Vishing that drives an Entra registration or consent flow is the confirmed initial access in at least two 2026 cases. Require out-of-band verification before any agent assists with MFA registration, device enrollment, or app consent, and treat urgency on a phone call as a signal rather than a reason.
- Alert on bulk CRM read volume, not just failed logins. These intrusions authenticate cleanly. The detectable artifact is anomalous query and export volume from a single application identity against objects like Contacts, so baseline it and alarm on the deviation.
- Restrict user consent to applications and use admin consent workflows. Inherited application privilege is the pivot that turns one compromised account into a full CRM extraction.
- Plan for the leak, not just the intrusion. Brinks Home's public notice, telling customers to stay vigilant against unsolicited emails, texts, and calls requesting personal information or credentials, is the right template. Stolen retail customer records feed directly into follow-on phishing and vishing, including against the next target.
- If you are Carhartt-adjacent, watch for AG filings. Retailers, suppliers, and partners should monitor state attorney general breach portals over the coming weeks. That is where a confirmed scope will appear first, if it appears at all.
Sources: ShinyHunters claims Carhartt data breach involving millions of cust... | Defending SaaS-based applications against ShinyHunters OAuth abuse... | ShinyHunters claims Brinks Home breach, threatens to leak stolen data | Brinks Home Discloses Data Breach as Hackers Leak Files - SecurityWeek | ShinyHunters called cancer diagnostics biz and tricked staffers int... | Chick-fil-A data breach affects more than 13,000 customers | ShinyHunters Claims Carhartt as a New Victim, While a Second Threat... | DarknetSearch: Dark Web Monitoring & Cyber Threat Solution