/
← Voltar ao feed
medium retail

ShinyHunters Carhartt data leak found to be largely synthetic TPC-DS data, cutting 24.9M claimed emails to about 13M

1 fonte(s) · 1 atualização(ões) · publicado 25/08/2026 18:51 · coletado há 4 dias

Troy Hunt of Have I Been Pwned (HIBP) analysed the leak that ShinyHunters attributed to Carhartt. The leak was claimed to hold more than 50 GB of customer and employee records. The initial extraction showed 24,876,077 unique email addresses. Closer review showed that a large share came from the TPC-DS benchmark dataset (tpcds_sf1000) stored in the same Databricks instance as real data. Hunt concludes that Carhartt was almost certainly breached, but that ShinyHunters most likely did not fabricate the data. The dump simply included synthetic test data, and some other outlets repeated the inflated figure. Cleaning is still in progress, and the count had fallen to about 12.97M at the point the article cuts off.

Detalhes técnicos

  • The data came from a Databricks dump under databricks_dump/.../samples/tpcds_sf1000/customer, in roughly 600 customer_chunk_XXXX.csv files and a further ~1,200 chunk files.
  • The records follow the TPC-DS customer schema: name, salutation, DOB, birth country, preferred-customer flag and email. The address is a foreign key, and c_login is empty, so there are no passwords.
  • Synthetic indicators:
    • 97.6% of the 10.35M unique domains appear only once, and many are gibberish (e.g. [email protected]/.edu/.org).
    • Birth country is uniform across about 211 countries, with only about 407 US records.
    • Birth year is flat from 1924 to 1992.
    • Real Carhartt records are also present, such as freemail addresses with a roughly 70% HIBP hit rate.
  • Cleaning steps and counts:
    • Excluding the synthetic chunk files gave 13,306,258 addresses.
    • Removing 5,736 Microsoft 365 alias duplicates (carhartt.com, carhartt.onmicrosoft.com, carhartt.mail.onmicrosoft.com) gave 13,300,522.
    • Handling 288,982 deactivate- soft-delete addresses (285,808 removed, 3,174 renamed) gave 13,014,714.
    • Removing 48,787 wctest.com perftest addresses gave 12,965,927.
    • The 32,514 carharttdonotship.com perftest addresses were also being dropped.
  • Hunt used an AI assistant (OpenClaw, nicknamed "PwnedClaw") for analysis, and noted that manual review still caught patterns the AI missed.
  • Hunt notes that he has reviewed nearly 100 ShinyHunters breaches and has yet to see one with fabricated data.

Remediação

  • Breach-notification services and journalists should validate claimed record counts before publishing. Useful checks are domain frequency, birth-country and birth-year distributions, and test-domain and alias normalisation.
  • Deduplicate Microsoft 365 alias variants and soft-deleted (deactivate-) accounts, and exclude test accounts, before counting affected individuals.
  • Carhartt customers should treat the incident as a real but over-stated exposure. The article does not give guidance for individuals.

Linha do tempo

  1. troyhunt.com ↗ · pub. 25/08/2026 18:51 · coletado 19/10 17:56 primeiro registro

    ShinyHunters Carhartt data leak found to be largely synthetic TPC-DS data, cutting 24.9M claimed emails to about 13M

    ler a análise desta fonte

    Troy Hunt of Have I Been Pwned (HIBP) analysed the leak that ShinyHunters attributed to Carhartt. The leak was claimed to hold more than 50 GB of customer and employee records. The initial extraction showed 24,876,077 unique email addresses. Closer review showed that a large share came from the TPC-DS benchmark dataset (tpcds_sf1000) stored in the same Databricks instance as real data. Hunt concludes that Carhartt was almost certainly breached, but that ShinyHunters most likely did not fabricate the data. The dump simply included synthetic test data, and some other outlets repeated the inflated figure. Cleaning is still in progress, and the count had fallen to about 12.97M at the point the article cuts off.

    Technical Details

    • The data came from a Databricks dump under databricks_dump/.../samples/tpcds_sf1000/customer, in roughly 600 customer_chunk_XXXX.csv files and a further ~1,200 chunk files.
    • The records follow the TPC-DS customer schema: name, salutation, DOB, birth country, preferred-customer flag and email. The address is a foreign key, and c_login is empty, so there are no passwords.
    • Synthetic indicators:
      • 97.6% of the 10.35M unique domains appear only once, and many are gibberish (e.g. [email protected]/.edu/.org).
      • Birth country is uniform across about 211 countries, with only about 407 US records.
      • Birth year is flat from 1924 to 1992.
      • Real Carhartt records are also present, such as freemail addresses with a roughly 70% HIBP hit rate.
    • Cleaning steps and counts:
      • Excluding the synthetic chunk files gave 13,306,258 addresses.
      • Removing 5,736 Microsoft 365 alias duplicates (carhartt.com, carhartt.onmicrosoft.com, carhartt.mail.onmicrosoft.com) gave 13,300,522.
      • Handling 288,982 deactivate- soft-delete addresses (285,808 removed, 3,174 renamed) gave 13,014,714.
      • Removing 48,787 wctest.com perftest addresses gave 12,965,927.
      • The 32,514 carharttdonotship.com perftest addresses were also being dropped.
    • Hunt used an AI assistant (OpenClaw, nicknamed "PwnedClaw") for analysis, and noted that manual review still caught patterns the AI missed.
    • Hunt notes that he has reviewed nearly 100 ShinyHunters breaches and has yet to see one with fabricated data.

    Remediation

    • Breach-notification services and journalists should validate claimed record counts before publishing. Useful checks are domain frequency, birth-country and birth-year distributions, and test-domain and alias normalisation.
    • Deduplicate Microsoft 365 alias variants and soft-deleted (deactivate-) accounts, and exclude test accounts, before counting affected individuals.
    • Carhartt customers should treat the incident as a real but over-stated exposure. The article does not give guidance for individuals.