ShinyHunters dumps 12.9 million Carhartt records after a refused $3.3 million ransom

Databricks is the detail to carry forward. Troy Hunt traced the published archive to the compromise of Carhartt's Databricks analytics platform ^[6], and that puts this in the same class as the rest of ShinyHunters' year: more than a dozen Snowflake customers, hundreds of claimed Salesforce customers in the Aura and Salesloft Drift campaigns, and over 1.5 billion records claimed across those two ^[3], followed most recently by more than 100 organizations hit through an Oracle PeopleSoft zero-day ^[4]. The consistent target is the aggregated copy, the analytics tenant or the CRM, where one working credential returns the whole customer base in a single pull.

The refusal is the part operators can price. ShinyHunters asked $3.3 million and published after Carhartt declined ^[14]. Hunt counts more than 12.9 million affected accounts ^[7]. That is roughly 26 cents per exposed account for the option of keeping the archive off a dark web site ^[16], an option that expires the moment the data is indexed and searchable.

Read the field list before assuming stuffing risk. Hunt enumerates unique email addresses, names, phone numbers and physical addresses ^[7]. No passwords or hashes appear in that list ^[13]. On its own this dump does not log anyone into anything. What it does is match a real person to a real mailbox and a real street address at scale, which is the raw material for reset-flow abuse and for phishing that quotes back an order history. The gang's own description adds customer metadata it called royalty info alongside employee and internal corporate data ^[1]. Millions of synthetic records that pointed at nobody were stripped out of the count ^[8].

The employee number is the awkward one. Hunt found over 15,000 mailboxes on the carhartt.com domain inside the leaked database ^[2], against a company that reports more than 3,000 employees in the United States and Europe ^[10]. That is about five times the stated headcount ^[12], which points at years of accumulated former staff, service accounts, or non-employee addresses sitting in the same analytics store as the customer table. Those are the addresses that matter for the next intrusion, because credentials belonging to people with access to a data platform are precisely what this group has been buying, phishing and reusing.

Two things about the non-payment story are single-sourced. The $3.3 million figure and the negotiator's line, that after careful review and internal discussions with leadership the company decided not to move forward with negotiations or further discussions, come from ShinyHunters' own account ^[15]. Carhartt has not confirmed the breach, has issued no statement, and had no spokesperson available to BleepingComputer ^[9]. The archive is public and the record count is independently measured by Have I Been Pwned; the negotiation transcript is the extortionist's telling of it. Treat the first as evidence and the second as claim.