Carhartt Data Breach Exposes Personal Information for Millions of Customers

Carhartt, the workwear and clothing retailer, has confirmed a data breach after a hacking group calling itself ShinyHunters stole customer information, including 12.9M unique email addresses, names, phone numbers, and physical addresses. The group threatened to leak the data unless Carhartt paid a ransom. Here's what Carefull knows so far and the steps you can take to protect yourself.

What happened in the Carhartt data breach?

In August 2026, ShinyHunters broke into Carhartt's systems and copied a large batch of customer data. They told Carhartt it would publish the stolen files unless the company paid roughly $3.3 million. Carhartt declined, telling the scammers: "After careful review and internal discussions with leadership, we have decided not to move forward with negotiations or further discussions."

On Thursday, August 13, 2026, ShinyHunters posted the data to its dark web leak site.

The group claimed to have stolen over 50GB of data and approximately 24.9 million email addresses. But independent security researcher Troy Hunt, who runs the breach-tracking site Have I Been Pwned, dug into the file before adding it to his database. He found that nearly half of the records weren't real. The leaked file mixed legitimate Carhartt customer data with "test" records (placeholder entries companies sometimes use internally to check their systems, not real customers.) After removing the fake entries, Hunt confirmed roughly 12.9 million real accounts were affected.

It’s currently unclear if passwords, Social Security numbers, or credit card details were part of the leak, but it's important to stay alert either way.

Why this breach matters

On it’s own, your name, email, phone number, and home address may not seem like a big deal. But together, they are what scammers need to make a fake message feel real.

With this information, a scammer can send a text or email that looks like it's from Carhartt about a "return," a "shipping problem," or a "security alert" on your account, and use your real name and address to make it convincing. A caller could also reference your address or account to sound legitimate before asking you to verify other information or transfer money. The goal is to get you to click a link, share a code, or hand over sensitive information scammers can use to steal your money.

What should you do if your information was exposed?

• Check if your information was part of the breach. Let Carefull's dark-web monitoring do the checking for you.
• Watch for phishing emails, texts, or calls that claim to be from Carhartt. Be especially cautious of messages about orders, returns, or "account security" that ask you to click a link or call a number.
• Go directly to carhartt.com instead of clicking links in messages. If you want to check an order or your account, type the address in yourself rather than tapping a link.
• Use a unique password for your Carhartt account, and turn on two-factor authentication. This is especially important if you've ever reused that password anywhere else.
• Don't immediately trust a caller knowing your name, address, or order details. Scammers often use stolen data to sound credible. If you're unsure, hang up and call the company back using a number from its official website.
• Keep an eye on your accounts for unusual activity. If you tend to reuse passwords across multiple websites or accounts, a breach at one company can sometimes lead to breaches elsewhere.

‍

A Carefull alert is an early warning

If your information turns up in a breach such as this, Carefull includes dark-web monitoring in our platform, so you can be alerted sooner if a scammer has already tried to use it. Carefull's job is to keep you informed about potential risks and how you can keep your information safe. But just because you receive a breach alert does not necessarily mean your accounts have been compromised. It just means that your information was found as part of a data breach and you should keep an eye out for any other suspicious activity.

What this means for you

Data breach headlines can be concerning if it involves a company you've shopped with. It's worth spending a few minutes to check whether you were affected and to be a little more skeptical of unexpected messages for the foreseeable future. Scammers are constantly changing their tactics, but staying informed is one of the best ways to protect yourself and your loved ones. 

‍Carefull helps spot risks like data breaches early, so you are able to act quickly before they turn into bigger problems.