Loading story…
ShinyHunters targeted clothing retailer Carhartt in a “pay or leak” extortion campaign and published data allegedly taken from the company. The validated portion contains approximately 12.9 million unique email addresses, alongside names, telephone numbers, and physical addresses; internal and customer-origin indicators support that Carhartt was genuinely breached.
The initial claim of 24,876,077 email addresses was substantially overstated because the published dataset included millions of synthetic records from TPC-DS benchmark data in a Databricks environment. Researchers excluded those sample files, as well as duplicate, deactivated, and internal performance-test records, reducing the count to 12,933,413 addresses; the analysis found no evidence that ShinyHunters fabricated the remaining data.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Clothing retailer Carhartt was targeted in a ShinyHunters “pay or leak” extortion campaign.
Have I Been Pwned founder Troy Hunt analyzed ShinyHunters' 50 GB archive and linked the exposed data to a compromise of Carhartt's Databricks analytics platform. The archive included more than 15,000 employee records using @carhartt.com addresses, alongside customer and other records.
An analysis of the published dataset identified TPC-DS synthetic benchmark records in Databricks sample paths and removed them along with duplicate aliases, deactivated accounts, and internal test data. The resulting dataset contained 12,933,413 email addresses, with remaining internal and customer indicators supporting that Carhartt was genuinely breached.
ShinyHunters subsequently published data allegedly obtained from Carhartt, including names, phone numbers, physical addresses, and 12.9 million unique email addresses. The published corpus also included millions of synthetic records not associated with real individuals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
9 references tracked. Mallory keeps watching after this page renders.
securitymagazine.com
Open sourcebleepingcomputer.com
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourcecyberveille.ch
Open sourcetheregister.com
Open sourcetroyhunt.com
Open sourcehaveibeenpwned.com
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Data allegedly sourced from US automotive retailer **CarMax** was published online after a **failed extortion attempt**, according to a Have I Been Pwned breach entry. The exposed dataset reportedly includes **431,000 unique email addresses** along with **names, phone numbers, and physical addresses**, indicating a PII-heavy leak that could enable targeted phishing and identity-focused fraud. Separately, **CarGurus** was reported as being purportedly breached by the **ShinyHunters** hacking operation, with claims of **1.7 million corporate files** stolen and an extortion deadline tied to negotiations. The intrusion was alleged to have occurred via **single sign-on (SSO) codes obtained through voice phishing**, consistent with ShinyHunters’ prior claims of compromising other organizations using SSO-code access; CarGurus has been positioned as another extortion-driven theft where internal records and PII may be at risk of exposure.
Jun 29, 2026
**CarGurus** customer data was published online in a leak attributed to the **ShinyHunters** extortion group, exposing roughly **12.4–12.5 million** accounts. A **6.1GB** archive was posted and subsequently ingested by *Have I Been Pwned* (HIBP) after validation checks; HIBP reported the dataset includes **email addresses, IP addresses, full names, phone numbers, physical addresses, user account IDs**, and additional sensitive business/transactional fields such as **finance pre-qualification application data, finance application outcomes, dealer account details, subscription information**, and account ID mappings. HIBP indicated about **70%** of the data had appeared in prior breaches already tracked by the service, implying roughly **3.7 million** records may be newly exposed; the public availability of the dataset increases risk of **targeted phishing and fraud** using the enriched identity and financing-related attributes. CarGurus had not publicly confirmed the incident at the time of reporting and did not respond to media requests, while HIBP and reporting attributed the breach to ShinyHunters, a group known for **social engineering/vishing-style** intrusions and subsequent extortion/leak tactics. Separate ShinyHunters-linked incidents reported in the same period included **Wynn Resorts** confirming theft of employee data following an extortion threat, and **Optimizely** disclosing a breach tied to a **voice-phishing** attack that exposed limited business contact information; these are distinct events and do not change the core CarGurus exposure but reinforce the group’s ongoing operational tempo and reliance on social engineering to obtain access and data for leverage.
Jun 29, 2026
ShinyHunters, a financially motivated data-theft and extortion group active since 2020, has continued targeting organizations across entertainment, healthcare, education, and criminal infrastructure. Rockstar Games confirmed that attackers accessed a limited amount of non-material company information through a third-party cloud provider, while maintaining that players and operations were unaffected. In a separate September campaign, data allegedly stolen from Swiss medical-device maker Medela was publicly released after a “pay or leak” extortion attempt; the dataset reportedly included roughly 424,000 unique email addresses, corporate contact details, and some support tickets. The group has also claimed attacks against other cybercriminals: it allegedly exploited `CVE-2026-42608`, an unauthenticated path-traversal flaw in Grav CMS, to compromise and deface Clop’s former Tor leak-site server and demand payment. Grav released version 1.7.53.4 after the issue, which had previously been fixed only in the 2.0 branch. Reporting also links ShinyHunters to the theft of more than one billion Salesforce-customer records in 2025 and disruption of the Canvas learning platform in 2026, underscoring how repeated data exposures can be combined into identity profiles that enable account takeover, fraud, and targeted scams.
Sep 30, 2026