How many people were affected by the Carhartt data breach?

Have I Been Pwned lists 12,933,413 unique email addresses in the Carhartt breach. Higher figures near 24.9 million were reported early on; roughly half of the published corpus was synthetic benchmark data that did not relate to real people and was excluded.

When did the Carhartt data breach happen?

Have I Been Pwned records the breach date as 13 August 2026 and added the dataset on 25 August 2026. Carhartt has not published a statement giving its own timeline for when access occurred.

Has Carhartt confirmed the data breach?

As of 26 August 2026 Carhartt has issued no public statement. The dataset is verified independently by Have I Been Pwned, whose record for the breach carries no company disclosure link.

What should I do if my email was in the Carhartt breach?

Treat any Carhartt-branded message about an order as unverified and open carhartt.com directly rather than using a link in the message. Expect text messages as well as email, since phone numbers were exposed. Strengthen sign-in on your email account, because that account is the reset route into most of your others.

Carhartt Data Breach | OptMsg Breach Breakdown

Q: What data was exposed in the Carhartt breach?

Email addresses, names, phone numbers and physical addresses. No passwords appear among the exposed data classes recorded by Have I Been Pwned.

The email arrives on a Tuesday and it looks right. Your first name at the top. A reference to the address your last order shipped to. A note that there is a problem with the delivery, and a link to fix it. Nothing about it feels like a scam, because almost nothing in it was a guess. The Carhartt data breach published your name, your phone number, your shipping address and your email address together in August. So whoever sent that message did not need to know a single thing about you that the leak had not already told them.

If you have bought Carhartt online, this is worth ten minutes of your attention.

What Company Was Breached?

Carhartt is the US clothing retailer. Data described as its customer records appeared online in August 2026, after a ShinyHunters “pay or leak” extortion campaign named the company.

Have I Been Pwned lists the breach against the domain carhartt.com. Carhartt itself has published no statement about the incident. So everything below comes from the dataset and from the people who analyzed it, rather than from the company.

When Did the Carhartt Data Breach Occur?

Have I Been Pwned records the breach date as 13 August 2026 and added the verified dataset to its index on 25 August 2026.

Those are two different dates and the distinction matters. The first is when the data surfaced publicly. Carhartt has not stated when the underlying access actually happened, or for how long. Until it does, the honest answer is that nobody outside the company knows.

What Was Stolen?

Have I Been Pwned lists 12,933,413 unique email addresses in the Carhartt breach, alongside names, phone numbers and physical addresses. No passwords appear among the exposed data types.

The figure you may have seen reported is higher, and it is worth knowing why. The raw published corpus yielded close to 24.9 million email addresses, and several outlets reported a number in that range. But when Have I Been Pwned’s Troy Hunt analyzed the data, roughly half of it turned out to be synthetic. A standard database benchmarking tool had generated those records, and they had been sitting in the same system as the real customer data, so the attackers scooped them up with it. Addresses like violet.day@ob7.edu do not belong to anybody. Hunt then removed those, plus duplicate routing aliases, deactivated-account rows and internal test records. The count of addresses that represent real people came to 12,933,413.

Of those, 83% were already in Have I Been Pwned from earlier breaches.

How Can the Carhartt Data Breach Be Used Against You?

An email address published next to a real name, phone number and shipping address makes a fake delivery or order-problem message far harder to spot than a generic one.

The specific things to expect:

A fake delivery or order notice referencing a real address, asking you to click a link to reschedule, pay a small fee, or confirm details.
A fake refund or “we owe you” message — retail breaches reliably produce these, because the offer of money owed is what gets a careful person to click.
Text messages and phone calls, because the phone numbers went out with the addresses.
Steadily more junk mail, as spammers resell and reuse the address list long after the news cycle ends.

What is not indicated here: there are no passwords and no payment card numbers in the exposed data classes. So this is not a case where someone can take your login and open your accounts. The risk is what arrives, and how convincing it looks when it does.

How to Protect Yourself

Check whether your address is in it. Have I Been Pwned’s search is free and takes a few seconds.
Treat any Carhartt-branded message about an order as unverified. If you want to check an order, open carhartt.com yourself and sign in there. Do not use the link in the message — that one rule defeats most of what follows a breach like this.
Be suspicious of texts and calls too. Your number went out with your address, and the same script works over SMS.
Turn on stronger sign-in where you have the option — passkeys or an authenticator app rather than a code by text. Start with your email account, because that account is how most of your others get reset.
Use a separate email address for retail sign-ups. The next retailer to suffer a breach will leak whatever address you gave them. Keeping that address away from your banking and account-recovery mail limits what any one leak is worth.
Watch for identity misuse rather than assuming it. There are no Social Security numbers or card numbers in this dataset, so a credit freeze is a precaution here rather than an indicated response. But it is free, and if you have been in several breaches it is a reasonable thing to do anyway.

How OptMsg Helps

OptMsg is an opt-in email service. Mail from a sender you have not approved goes to Trash, not your Inbox, and auto-deletes after 30 days. That is the whole of the patent-pending opt-in technology, and it is deliberately simple.

Be clear about what that does and does not change here. OptMsg had nothing to do with Carhartt’s systems and would not have changed what happened inside them. Nobody can un-publish an address once it is out, and no email service can pull it back off the lists it is now on.

What changes is the destination. Once your address is circulating, the mail written from it starts arriving. But on an opt-in inbox, the fake delivery notice from a sender you have not approved lands in Trash. It does not sit in your Inbox next to real mail, looking like real mail. If you are worried something got misfiled, the 30-day Trash window means it is still there to check.

That is a smaller claim than “you are protected”, and it is the accurate one. If the part of the Carhartt data breach that worries you is a convincing fake landing where you trust things to be real, that is the part an opt-in inbox is built for. You can create an OptMsg account and see how your own inbox behaves, or read more about how OptMsg approaches account security.

Create Your Account