Carhartt data breach claims inflated by synthetic data, analysis finds

Security expert Troy Hunt has determined that the data breach affecting Carhartt, a workwear and fashion retailer, was significantly less severe than initially claimed by the cybercriminal group ShinyHunters. Hunt's analysis, conducted before uploading the data to his Have I Been Pwned website, revealed that approximately 12.9 million individuals were affected, which is about half of the number reported by ShinyHunters, based on information published by The Register.

ShinyHunters had claimed to leak 50GB of Carhartt's data on August 13, following a negotiation attempt after an initial extortion demand of $3.3 million. However, Hunt's investigation, utilizing tools like OpenClaw, uncovered millions of lines of synthetic data injected into the dump, inflating the number of affected individuals. Anomalies such as .edu and .org email domains with random strings, customers listed in unlikely countries like Benin and Montenegro, and birth dates in the early 1900s pointed to fabricated information.

After filtering out this bogus data, the estimated number of genuine individuals dropped from nearly 25 million to 13.6 million, and further refinement led to the final figure of 12,933,413 genuine accounts. The actual compromised data includes names, email addresses, phone numbers, and physical addresses. Carhartt has not publicly commented on the breach or Hunt's findings.

Source: The Register