Every headline today puts the Carhartt breach at 12.9 million accounts. That number did not come from Carhartt, which has said nothing publicly, and it did not come from the attackers, who claimed roughly twice as many. It is a researcher’s downward correction — and the reason nearly half the dump evaporated under scrutiny is a lesson worth more than the breach itself.
What happened
ShinyHunters published data attributed to Carhartt in mid-August, claiming more than 50GB compressed covering customer, employee, and corporate records. The raw dump contained 24.8 million unique email addresses.
Troy Hunt’s analysis, now loaded into Have I Been Pwned, puts the real figure at 12.9 million accounts, after discarding approximately 11.9 million records — about 47% of the dump — as not corresponding to real people.
The bulk of the discard, some 11.25 million records, was synthetic TPC-DS benchmark data. TPC-DS is a standard decision-support benchmark used to test the performance of analytics and data warehouse systems. Its generated rows are identifiable once you know what to look for: fabricated email domains and birth years distributed uniformly across 1924 to 1992. The remainder of the discard was Microsoft 365 routing aliases and internal accounts with names like perftest and deactivate- prefixes.
What survived is real, and it is not trivial. The verified records include names, email addresses, phone numbers, physical addresses, dates of birth, salutations, birth countries, and first-purchase dates. More than 15,000 @carhartt.com employee addresses are in there too.
Carhartt has said nothing
This is the part that should shape how you read every version of this story. There is no Carhartt statement. There is no breach notification on the company’s site. There is no entry on the California Attorney General’s breach notification portal. Reporters have asked; The Register noted the company “is yet to comment on the breach anywhere publicly,” and BleepingComputer reported a spokesperson was not immediately available.
So the chain of custody for the number in every headline runs: attackers published a dump → a researcher analyzed it and revised the count downward → publications reported the researcher’s figure. At no point does the affected company appear. If you are briefing anyone on this, the correct phrasing is “researcher analysis of data published by ShinyHunters indicates approximately 12.9 million accounts,” not “Carhartt disclosed.”
Several claims attached to this story come from ShinyHunters alone and have no corroboration: that the entry point was a compromised Databricks analytics platform, that a $3.3 million extortion demand was made, and that it was refused. We are not printing those as fact. They may well be true. Nothing confirms them.
Why it matters
The interesting question is not how big the breach was. It is why nobody — including, apparently, the attackers — could tell.
Eleven and a quarter million rows of database benchmark data were sitting in the same environment as real customer records. Someone ran a TPC-DS workload to size or test an analytics platform, and the generated dataset was never cleaned out. When that environment was taken, the synthetic rows left with everything else, indistinguishable from real people until a researcher who knew the benchmark’s fingerprint went looking.
Work through the consequences of that for a moment. If this had gone the ordinary route — a regulator asking how many people were affected, a notification obligation with a deadline attached — the honest answer would have been that the company could not say. Not because forensics were incomplete, but because the data itself could not be sorted into real and fake without specialist analysis of a benchmark schema. Every downstream decision depends on that number: who gets notified, in which jurisdictions, on what clock, at what cost.
There is a second-order problem too. Test and benchmark data in production analytics environments does not just inflate breach counts. It skews the models trained on it, corrupts the metrics computed from it, and — because it looks like customer data — tends to inherit whatever access controls customer data has, which is to say fewer than it should.
The 15,000 employee addresses deserve their own line. Corporate email addresses in a public dump are raw material for credential stuffing and for targeted phishing against a company that has not yet acknowledged it has a problem.
The verification gap
Step back from Carhartt for a second and look at who did the work here.
An attacker published a dump and made a claim about its size. The affected company said nothing. No regulator has said anything. The number that every publication is now using, and that will end up in the running tallies of “biggest breaches of 2026,” was established by one independent researcher who recognized a database benchmark schema by its birth-year distribution.
That is not a criticism of the researcher. It is an observation that breach scale — the input to notification obligations, regulatory exposure, and every “how bad was it” conversation in the industry — is increasingly established by whoever bothers to look, on no particular timeline, with no obligation to look at all. Roughly 47% of this dump was fictional. Nothing in the process that produces breach headlines would have caught that.
The practical takeaway for anyone running IT: if your organization ends up in this position, the count that sticks is the one that gets published first and analyzed best, and it will not necessarily be yours. Being able to produce a defensible number quickly is a capability, and it starts with knowing what is actually in your data stores before anything goes wrong.
What to do
- Audit what synthetic and benchmark datasets are sitting in your production analytics environments. TPC-DS, TPC-H, generated load-test fixtures, anonymized-but-not-really exports. If you cannot answer where they are, you cannot answer how many people a breach affected.
- Check whether test data inherits production access controls. It usually does, in the wrong direction — it gets the same permissive treatment as the real thing while receiving none of the scrutiny.
- Make “can we count the victims” part of your incident response tabletop. Most exercises assume the number is knowable. This one wasn’t.
- If you are downstream of Carhartt as a supplier or partner, note that 15,000 employee addresses are public and act accordingly on inbound mail purporting to come from them.
Sourcing note
The 12.9 million figure and the composition analysis are Troy Hunt’s, published on his site and reflected in the Have I Been Pwned breach entry. Carhartt has issued no statement of any kind, and no notification appears on the California AG portal; we did not check Maine, Texas, or Washington. The 50GB volume, the 24.8 million raw email count, the Databricks attack vector, the $3.3 million demand and its refusal are all ShinyHunters’ claims, and only the data volume has been independently examined. No regulator has confirmed anything about this incident.