Carhartt data breach exposes information of 12.9 million accounts
ShinyHunters group leaks 12.9 million Carhartt accounts after ransom demand fails.
Run Carhartt?
Get an email when a reviewed story names Carhartt, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The ShinyHunters extortion group has published sensitive data from nearly 13 million accounts stolen from clothing retailer Carhartt. The group claimed the attack on August 13, stealing over 50GB of data including customer and employee PII. After Carhartt refused to negotiate a $3.3 million ransom, ShinyHunters released the data on the dark web.
The lesson from this incident
Full lessonThe Carhartt breach highlights the severe consequences of storing large volumes of unprotected customer and employee PII at scale, making it an attractive target for extortion groups like ShinyHunters. When Carhartt declined to pay the $3.3 million ransom, the attackers followed through on their threat by publicly releasing over 50GB of sensitive data on the dark web. This case underscores that refusing to pay ransoms—while the correct ethical and legal stance—must be backed by a robust incident response plan and pre-existing data minimization practices to limit the blast radius of any breach. Organizations must assume that stolen data will eventually be published and prepare affected individuals and stakeholders accordingly.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
Indicators of Compromise
- domain — carhartt.com