Carhartt Leaks 12.9M Accounts; ATF Hit by Ransomware

KEMETIC MINDS
Cybersecurity & Scam Daily Briefing — August 27, 2026

Photo: Gustavo Fring via Pexels (source)

• ShinyHunters dumped 50GB of Carhartt data — 12.9 million accounts are exposed (BleepingComputer, 2026).
• The DOJ confirmed that ransomware hit the ATF; the Qilin gang claims the attack (MSN News, 2026a; MSN News, 2026b).
• July set a 2026 record: 894 ransomware victim listings, up 22% from June (ZDNET, 2026).
• More than 15,000 @carhartt.com employee emails are in the leaked archive (BleepingComputer, 2026).
• 41% of July’s ransomware incidents hit U.S. organizations (ZDNET, 2026).

1. Carhartt Data Breach: 12.9 Million Accounts Dumped

Watch how a real fake breach settlement email unfolds — and the red flags that give it away.

The ShinyHunters extortion group has published a 50GB archive of data stolen from workwear retailer Carhartt, and breach notification service Have I Been Pwned says it exposes roughly 12.9 million accounts (BleepingComputer, 2026).

The leaked records include email addresses, names, phone numbers, and physical addresses — plus more than 15,000 employee emails ending in @carhartt.com (BleepingComputer, 2026).

ShinyHunters claimed the attack on August 13 and demanded a $3.3 million ransom; Carhartt’s negotiator told the gang the company would not negotiate, and the data was then released on the dark web (BleepingComputer, 2026).

Have I Been Pwned founder Troy Hunt linked the leak to a compromise of Carhartt’s Databricks analytics platform — a cloud system that combines business reporting and data storage (BleepingComputer, 2026).

How to Avoid This Scam

• If you have a Carhartt account, look up your email on Have I Been Pwned and change that password — plus any other site where you reused it (BleepingComputer, 2026).
• Expect phishing that uses your real name, phone number, or street address to sound legitimate — the leak handed scammers those exact details (BleepingComputer, 2026).
• Ignore “order update,” “refund,” or “reward” messages from Carhartt that arrive by text or email; log in at the official site directly instead.
• Turn on multi-factor authentication on your email and shopping accounts so a leaked password alone won’t unlock them.

2. ATF Ransomware: DOJ Confirms Breach After Dark Web Claims

Watch how a real fake government breach alert unfolds — and the red flags that give it away.

The Department of Justice and the Bureau of Alcohol, Tobacco, Firearms and Explosives have confirmed a cybersecurity breach of an agency system (MSN News, 2026b).

According to MSN News, the confirmation follows dark web claims made by a Russian-linked cyber gang (MSN News, 2026b). No details about what data was taken or which system was hit have been released yet (MSN News, 2026b).

How to Avoid This Scam

• Get your facts from atf.gov and justice.gov, not from forwarded messages or social media — criminals post fake versions of official notices after any breach makes news.
• If an email or text cites the ATF breach and asks you to “verify” information or click a link, delete it and visit the agency’s real website.
• Be wary of phone calls from people claiming to be federal agents — real agencies don’t demand payment, gift cards, or crypto over the phone.
• Don’t share personal information with anyone who contacts you about this breach; reach out to official channels yourself instead.

3. Qilin Claims Credit as ATF Declares ‘Major Incident’

Watch how a real post-breach 'data exposure' check unfolds — and the red flags that give it away.

The ATF is investigating a cybersecurity incident that Justice Department officials have designated a “major incident,” and the Qilin ransomware group is claiming credit (MSN News, 2026a).

According to MSN News, the “major incident” label signals the breach is serious enough to require urgent, coordinated federal response — not a routine IT problem (MSN News, 2026a).

Ransomware gangs steal data and then threaten to publish it unless they’re paid — the same pattern ShinyHunters used against Carhartt this month (BleepingComputer, 2026).

How to Avoid This Scam

• Any ATF-themed message you receive in the coming days is riding this news cycle; treat unsolicited notices as phishing until you verify them at an official site (MSN News, 2026a).
• If you do ATF-regulated business, confirm any agency communication using contact information you already have — never phone numbers or links inside the message.
• Don’t assume a criminal group’s claim is true; attackers often exaggerate or invent attacks, and only official confirmation counts (MSN News, 2026a).
• Never pay a ransom or extortion demand: Carhartt refused to negotiate with ShinyHunters, and its data was still published (BleepingComputer, 2026).

4. ATF Ransomware: Official Confirmation Lands Wednesday

Watch how a real ransomware-news phishing unfolds — and the red flags that give it away.

On Wednesday, a DOJ spokesperson confirmed that the Bureau of Alcohol, Tobacco, Firearms and Explosives has been hit with a ransomware attack (BizPacReview, 2026).

The official confirmation came only after the Qilin gang had already claimed the attack on the dark web (MSN News, 2026a) — a useful reminder, per BizPacReview, of how to read breaking breach news (BizPacReview, 2026).

How to Avoid This Scam

• Treat all unverified claims — from criminals or from social media — as rumor until the affected agency or company confirms them (BizPacReview, 2026).
• If a federal agency is breached, watch for lookalike “official” emails that arrive in the days after; verify the sender’s real domain before clicking anything.
• Criminals monetize big news fast, so pause before clicking any link about this story, even one from someone you trust — their accounts may be compromised.

5. July Ransomware Spike: 894 Victim Listings, 22% Jump

Watch how a real fake ransomware extortion email unfolds — and the red flags that give it away.

July 2026 was the worst month for ransomware victim claims this year: 894 victim organization listings, up 22% from June, according to NCC Group’s monthly threat advisory report (ZDNET, 2026).

Almost a third of attacks hit the industrial sector, followed by consumer services, technology, critical services, finance, and healthcare (ZDNET, 2026). Of recorded incidents, 41% occurred in the U.S., 29% in Europe, 14% in Asia, and 9% in South America (ZDNET, 2026).

Ten groups drove most of the activity: The Gentlemen led with 138 attributed attacks, followed by Quilin (127), Deadlock (84), and DragonForce (43) (ZDNET, 2026). Notable victims included Ernst & Young, Coca-Cola’s Fairlife subsidiary, and Analog Devices (ZDNET, 2026).

July also produced the first recorded fully agentic AI ransomware attack chain — one where an AI system carried out the attack largely on its own (ZDNET, 2026). ZDNET cautions, though, that cybercriminal egos may be inflating the numbers (ZDNET, 2026).

How to Avoid This Scam

• Because ransomware now hits industrial, finance, healthcare, and consumer companies families depend on, keep offline backups of irreplaceable family records, photos, and financial files (ZDNET, 2026).
• Treat urgent “your account was affected” messages — especially ones arriving within days of any breach announcement — as possible phishing, and verify through the official website (ZDNET, 2026).
• With AI-driven attacks on the rise, verify any money request by phone or in person even if the email or text looks polished (ZDNET, 2026).
• If a company you use is breached, follow its official guidance and assume criminals will send fake “your data was exposed” emails — the pattern repeats after every major attack (ZDNET, 2026).

What the Research Actually Says

No peer-reviewed studies were supplied for this briefing, so we are not going to cite academic findings we can’t verify. The data-backed findings below come from the threat analysis and reporting in today’s sources (ZDNET, 2026; BleepingComputer, 2026).

NCC Group’s July threat report shows ransomware clusters by sector and geography — industrial first, 41% U.S. — which means preparation should focus on the companies and agencies your family relies on daily (ZDNET, 2026).

Independent breach analysis works: Troy Hunt of Have I Been Pwned traced the Carhartt leak to the company’s Databricks analytics platform, identifying both the attack surface and the fact that over 15,000 employee emails were exposed (BleepingComputer, 2026).

Counts need skepticism: NCC Group recorded 894 victim listings in July, but ZDNET notes groups may inflate their numbers, so treat any single victim count — including the ones in this briefing — as directional, not exact (ZDNET, 2026).

Today’s Family Safety Checklist

• Search your email addresses on Have I Been Pwned today if you’ve ever bought from Carhartt — 12.9 million accounts are in the leaked archive (BleepingComputer, 2026).
• Change reused passwords and turn on multi-factor authentication, starting with email and banking — attackers use one leaked password to reach into other accounts (BleepingComputer, 2026).
• Back up family photos and key documents to an offline drive this week; July’s ransomware wave hit utilities, food companies, health care, and finance alike (ZDNET, 2026).
• Before acting on any breach notice you get by text, email, or phone, check the official source — as the ATF case shows, official confirmation lags criminals’ claims by days (MSN News, 2026b; BizPacReview, 2026).

References

1. Bing News. (2026, August 27). Carhartt data breach exposes information of 12.9 million accounts. bleepingcomputer.com
2. Bing News. (2026, August 27). DOJ confirms ransomware attack on ATF claimed by Russian cyber gang. msn.com
3. Bing News. (2026, August 26). ATF investigates 'major' cybersecurity incident as ransomware group claims attack. msn.com
4. Bing News. (2026, August 26). ATF hit by ransomware attack, DOJ says. bizpacreview.com
5. Bing News. (2026, August 26). July was the worst month for ransomware victim claims in 2026 – or was it?. zdnet.com