ShinyHunters group leaks Carhartt data affecting 12.9 million accounts after failed ransom

Data Leak Follows Failed Ransom Negotiation

The ShinyHunters extortion group released sensitive data from approximately 12.9 million Carhartt accounts. This action occurred after Carhartt declined to pay a $3.3 million ransom demanded by the group. ShinyHunters initially claimed the attack on August 13, stating they had stolen over 50GB of customer, employee, and corporate data.

Scope of Compromised Information

Analysis by Have I Been Pwned founder Troy Hunt confirmed that the leaked data includes unique email addresses, names, phone numbers, and physical addresses. The breach also affected over 15,000 employees with @carhartt.com email addresses. The cybercrime group stated that millions of customer records and extensive sensitive information, including personally identifiable information (PII) for employees and customers, were compromised.

Origin of the Breach

The data breach has been linked to a compromise of Carhartt's Databricks analytics platform. Databricks is a cloud-based data platform that integrates business reporting and data storage. Carhartt has not yet issued a public statement or confirmed the claims made by ShinyHunters regarding the breach.

Broader Context of ShinyHunters Activity

ShinyHunters has been associated with multiple security incidents over the past year. The group has been linked to breaches affecting over a dozen Snowflake customers and numerous third-party integration providers. They have also claimed responsibility for breaches impacting hundreds of Salesforce customers, asserting the theft of more than 1.5 billion records in total.