The leak
In August 2026, ShinyHunters claimed it breached Carhartt on August 13, demanded about $3.3 million, and after refusal posted about 50 GB. Carhartt had not publicly confirmed in BleepingComputer’s coverage.
What HIBP found
Troy Hunt linked the breach to Carhartt’s Databricks platform and counted about 12.9 million accounts, plus more than 15,000 @carhartt.com addresses. Synthetic records were excluded.
Why it matters
Customer data in cloud analytics ended up on an extortion site. Review Databricks/Snowflake access and PII inventory — “we do not negotiate” does not stop publication.