Have I Been Pwned Finds Half of ShinyHunters’ Carhartt Breach Data Was Synthetic

Workwear retailer Carhartt is the latest company caught up in a ShinyHunters extortion campaign, but the breach turned out to be a lesson in verification as much as a security incident. When Troy Hunt, the researcher behind Have I Been Pwned (HIBP), ran the leaked data through his usual analysis process this week, he found that roughly half of the records ShinyHunters dumped were not real people at all. An AI-assisted review cut his working estimate from just under 25 million addresses to 12,933,413, a number Hunt says would have looked twice as bad if he had stopped at the first pass.

A familiar extortion playbook

ShinyHunters announced the Carhartt breach on August 13, claiming to have stolen more than 50GB of compressed data that included customer records, employee information, customer metadata, and loyalty program details. According to The Register, the group said it published the data after Carhartt hired what the criminals called “a very unskilled and incompetent negotiator” to talk them down from a $3.3 million extortion demand. That framing comes from ShinyHunters itself; Carhartt has not confirmed or disputed it, and the company did not respond to The Register’s request for comment or say anything publicly about the incident.

Carhartt, the 1889-founded workwear brand now headquartered in Dearborn, Michigan, has expanded well beyond its blue-collar roots in recent years through its Carhartt WIP streetwear line, giving it a much larger and more international customer base than its original tradespeople-and-outdoor-workers audience.

How an AI-assisted review caught the padding

Hunt’s own account of the analysis, published August 26, describes his standard HIBP workflow: run the open source Email Address Extractor tool over a leaked corpus, get a count of unique addresses, and use that number to help prioritize processing. For Carhartt, that first pass returned 24,876,077 unique addresses, a figure that happened to line up with what other sites were already reporting about the breach’s scale, which initially reinforced Hunt’s impression that the whole dump was legitimate.

This time, Hunt also ran the data through an AI agent called OpenClaw, which he had already been using for various tasks throughout the year and nicknamed “PwnedClaw” for this particular session. The assistant flagged that the underlying files followed the TPC-DS schema, an industry-standard benchmark format used to generate synthetic test data for retail analytics systems, and that the data had come from Carhartt’s customer analytics warehouse in Databricks rather than a production transactional database. Rather than take that flag at face value, Hunt went back and pulled real examples from the data to confirm or disprove it.

What the synthetic records looked like

The evidence, once Hunt went looking, was hard to miss:

The corpus contained roughly 4 million .edu addresses and 3.9 million .org addresses, an abnormally high share for a clothing retailer, including obviously fabricated entries such as addresses on single-letter domains or domains made of random character strings. About 10.1 million domains appeared exactly once each across the whole dataset. Real breach data from a retail company typically follows a power-law pattern, with a relatively small number of common personal and corporate email domains accounting for a large share of addresses; a dataset dominated by one-off domains is a signature of synthetic generation instead.

The birth-country field was even more telling: it spread almost evenly across 211 countries at roughly 380 to 420 records each, with the United States appearing only 407 times, tied with Canada and dwarfed by countries such as Antigua and Barbuda and Lesotho. Birth years told the same story, spread uniformly across 1924 to 1992 at roughly 1,050 to 1,194 records per year, every single year, with no weighting toward any real population curve. Both patterns are what you would expect from a random number generator sampling a fixed range, not from an actual customer base concentrated in the United States and Europe.

The real numbers, and what was actually exposed

After stripping out the synthetic TPC-DS records, Hunt did a further round of manual cleanup, removing duplicate entries and tens of thousands of addresses on a Carhartt-linked suppression domain whose aliases were tagged “perftest,” marking them as internal performance-testing accounts rather than real customers. That left a final count of 12,933,413 accounts he assessed as genuine. That is the figure now listed on the Have I Been Pwned breach page for Carhartt, added to the service on August 25. The compromised data associated with those accounts includes email addresses, names, phone numbers, and physical addresses; the customer login field in the source data was empty, meaning no passwords were part of this exposure.

HIBP also found that 83 percent of the genuine addresses were already logged in the service from earlier, unrelated breaches, meaning the incremental new exposure from Carhartt is smaller still than the headline 12.9 million figure suggests.

Why the process matters as much as the number

Hunt was blunt about the lesson in his write-up: “You’re not going to believe this, but turns out you can’t always take criminals at their word.” His broader point is aimed at anyone who repeats a breach’s claimed scale without checking it themselves: “take headline numbers with a grain of salt unless you’re confident in the processes of those making the claims.”

The irony is not lost in the details. An AI assistant helped Hunt spot the pattern that something was wrong with the data in the first place, but the actual verification, pulling real examples, checking birth-country and domain distributions, and confirming the numbers by hand, was still manual work. For the roughly 12.9 million people whose real information was exposed, the practical advice is the same as any other breach: be alert to phishing attempts that use your name, email, phone number, or address to appear legitimate, and check whether your email address appears in this or other breaches through HIBP directly.