Carhartt Data Breach Hits 12.9M Accounts; US Breach Costs Top $10M

KEMETIC MINDS
Cybersecurity & Scam Daily Briefing — August 30, 2026

Photo: Gustavo Fring via Pexels (source)

• 12.9 million Carhartt accounts were exposed by the ShinyHunters hacking group (The Daily Hodl, 2026).
• The leak includes names, emails, phone numbers, addresses, and 15,000+ employee records (The Daily Hodl, 2026).
• A routine US breach now costs $10.22 million; slow detection adds $1.14 million (GCN, 2026).
• Berlin refuses to pay after Rhysida stole 5.79 TB of government data and listed it for 30 bitcoin (The Straits Times, 2026).
• ShinyHunters now favors cloud-service break-ins and vishing (phone-based phishing) over encryption (The Daily Hodl, 2026).

1. Carhartt Data Breach: 12.9 Million Accounts Exposed

Watch how a real breach-notice phishing unfolds — and the red flags that give it away.

Clothing maker Carhartt has suffered a data breach exposing information from 12.9 million user accounts (Bing News, 2026).

The exposed data includes names, emails, and more — exactly the details criminals use to make phishing messages look real (Bing News, 2026).

The ShinyHunters hacking group is reported to be responsible for the exposure (Bing News, 2026).

How to Avoid This Scam

• If you have a Carhartt online account, change the password now — and use one you haven’t used anywhere else.
• Be suspicious of any email or text addressed to you by name that claims to be from Carhartt; the leaked names and emails make fakes more convincing.
• Never click a link in an unexpected “order,” “rewards,” or “security alert” message — type the retailer’s website into your browser yourself.
• Never enter your password or payment details through a link sent by email or text.

2. Carhartt Extortion Breakdown: What the 50GB Leak Contains

Watch how a real fake breach compensation text unfolds — and the red flags that give it away.

ShinyHunters added Carhartt to its data-leak site after negotiations over a $3.3 million ransom demand broke down (The Daily Hodl, 2026).

The company allegedly replied: “After careful review and internal discussions with leadership, we have decided not to move forward with negotiations or further discussions.” (The Daily Hodl, 2026).

The attackers, who claimed responsibility on August 13, say the haul exceeds 50GB of customer, employee, and corporate files (The Daily Hodl, 2026). They described the trove as “millions of records of customer data and vast amount of sensitive information and PII [personally identifiable information] containing employee, customer, customer metadata (royalty info), and other internal corporate data.” (The Daily Hodl, 2026).

Security researcher Troy Hunt determined the records most likely originated from Carhartt’s Databricks analytics platform, a data-analysis service (The Daily Hodl, 2026). The database includes names, emails, phone numbers, and physical addresses, plus more than 15,000 records tied to @carhartt.com employee email addresses; millions of synthetic (test) records were excluded (The Daily Hodl, 2026).

ShinyHunters has shifted focus from encryption to data exfiltration through vishing (voice phishing) and breaches of SaaS (software-as-a-service) platforms, so stolen data is now often published rather than held for ransom (The Daily Hodl, 2026). Carhartt has not publicly confirmed the alleged breach or commented on the extortion claims (The Daily Hodl, 2026).

How to Avoid This Scam

• Assume your data is already circulating even though Carhartt hasn’t confirmed the breach — act now rather than waiting for an official notice.
• Expect vishing: ShinyHunters now uses voice phishing, so be suspicious of unexpected phone calls asking you to “verify” account details (The Daily Hodl, 2026).
• If a caller pressures you for a code, password, or payment, hang up and call the company back using the number on its official website.
• If you have a @carhartt.com email address, watch for targeted messages that appear to come from colleagues or executives.

3. The Price of Slow Detection: $10.22 Million Average Breach Cost

Watch how a real ai-fueled breach phishing email unfolds — and the red flags that give it away.

A routine data breach at a US company now averages $10.22 million in total losses, a 9% jump to an all-time high, while the global average fell 9% to $4.44 million (GCN, 2026).

Organizations took an average of 241 days to identify and contain a breach in the latest reporting period — a nine-year low, but still long enough to turn one intrusion into a multimillion-dollar crisis (GCN, 2026).

Breaches taking longer than 200 days to contain cost an average of $1.14 million more than faster ones, and detection and escalation have been the largest cost driver for four years (GCN, 2026).

The final bill includes detection, escalation, notification, lost business, and post-breach response — and it stacks up across months (GCN, 2026).

How to Avoid This Scam

• You can’t control how fast a company finds a breach — but you can control how fast you find misuse of your own accounts.
• Check bank and credit card statements weekly, so a fraudulent charge is caught in days instead of months.
• Set up account alerts for new logins and large transactions — early detection is the personal version of closing that $1.14 million gap.
• Use a unique password for every account so one company’s slow response doesn’t become your identity crisis.

4. Berlin Ransomware Auction: Rhysida Demands 30 Bitcoin

Watch how a real breach auction extortion unfolds — and the red flags that give it away.

The Rhysida ransomware group said on Aug 28 it is auctioning 5.79 terabytes of data stolen from Berlin state agencies, including 46,500 contracts, emails, phone numbers, passwords, and classified information (The Straits Times, 2026).

The group, which researchers say operates from Russia or Eastern Europe, set a starting price of 30 bitcoin with a countdown timer of just under seven days on its website (The Straits Times, 2026). Berlin had received ransom demands for an unspecified amount, German broadcaster RBB reported on Aug 27 (The Straits Times, 2026).

“The state of Berlin will not submit to extortion,” Berlin Mayor Kai Wegner and interior senator Iris Spranger said in a joint statement (The Straits Times, 2026). Officials could not yet say what data was taken, but they said the city’s election infrastructure was not affected and no election-related data was compromised, weeks before elections on Sept 20 (The Straits Times, 2026).

Rhysida has claimed nearly 280 attacks since it emerged in June 2023, and roughly half of its victims have been in the US (The Straits Times, 2026).

How to Avoid This Scam

• If you have ever dealt with Berlin state agencies, treat any unexpected message referencing Berlin government services with suspicion — the stolen emails and phone numbers can make phishing look official.
• Because passwords were stolen, change the password on any government portal you use, and never reuse it elsewhere.
• Watch for fake “Berlin election” or “voter registration” messages before the Sept 20 vote; officials say election systems were not breached, so unsolicited election messages are a scam risk.
• Understand that auctioned data is sold to other criminals — fraud attempts can continue for years, not just this week.

What the Research Actually Says

No new peer-reviewed journal studies were included in today’s briefing source set, so there are no fresh academic findings to cite this cycle. The data-backed figures in today’s coverage come from industry breach-cost research reported by GCN.

That research found that detection and escalation have been the single largest cost driver of data breaches for the past four years (GCN, 2026). It also found that breaches taking longer than 200 days to contain cost an average of $1.14 million more than faster responses (GCN, 2026).

For families, the practical lesson from that finding is that speed of detection is the most controllable cost: checking statements and account logins regularly is the household version of faster containment (GCN, 2026).

Today’s Family Safety Checklist

• Change reused passwords today. With Carhartt’s 12.9 million records and Berlin’s stolen passwords in criminal hands, one reused password can unlock many accounts (The Daily Hodl, 2026; The Straits Times, 2026).
• Treat unexpected calls as guilty until proven innocent. ShinyHunters uses vishing, and the leaked phone numbers make the calls more convincing (The Daily Hodl, 2026).
• Don’t wait for a breach notice to act. The longer misuse goes undetected, the more it costs — check accounts and statements this week (GCN, 2026).
• Remember that leaked data is sold and resold. Auctioned or published data fuels fraud attempts for years after the news cycle ends (The Straits Times, 2026).

References

1. Bing News. (2026, August 29). Carhartt data breach exposed information from 12.9 million user accounts. msn.com
2. Bing News. (2026, August 30). Clothing Retailer Breached, Affecting 12,900,000 Accounts – Names, Addresses and More Exposed. dailyhodl.com
3. Bing News. (2026, August 29). A routine US company data breach now averages $10.22 million in total losses, and the 241-day window before it is fully contained drives a gap no patch can close. gcn.com
4. Bing News. (2026, August 29). Ransomware group says it stole Berlin data, offers it for auction. straitstimes.com