The Carhartt Data Breach: 12.9 Million Accounts Compromised

The extortion group ShinyHunters has released to the public confidential data stolen from Carhartt, the American maker of workwear and streetwear. According to the Have I Been Pwned service, the breach affected more than 12.9 million accounts.

Founded in 1889, Carhartt operates manufacturing facilities in Kentucky and Tennessee and employs over 3,000 people across the United States and Europe. ShinyHunters first claimed responsibility for the attack itself back on August 13, reporting the theft of more than 50 GB of documents containing a wide range of customer, corporate and internal data.

What ended up in the archive

Have I Been Pwned founder Troy Hunt, after examining the leaked dump, linked the incident to a compromise of Carhartt's Databricks-based analytics platform — a cloud solution that combines business reporting with data storage. The leak included customers' unique email addresses, names, phone numbers and physical addresses. Hunt noted, however, that part of the trove consisted of millions of synthetic records not tied to real people — these were excluded from the count. The database also turned up more than 15,000 employees with addresses of the form @carhartt.com.

The release of the data was the fallout of a failed blackmail attempt: the attackers demanded a ransom of $3.3 million, but the company refused to negotiate. According to the hackers themselves, Carhartt's negotiator told them that, after internal discussions with management, the decision had been made not to continue the dialogue. Carhartt has yet to officially confirm the breach and did not respond to press inquiries.

A long track record

Over the past year, ShinyHunters has grown into one of the most prominent extortion groups. They are credited with breaching more than a dozen Snowflake customers, as well as campaigns against hundreds of Salesforce users — as part of the Salesforce Aura and Salesloft Drift operations, the hackers claim to have stolen more than 1.5 billion records. Just recently the group took responsibility for a series of attacks on more than 100 organizations through a zero-day vulnerability in Oracle PeopleSoft.

Among the victims named by the attackers themselves are the European Commission, Google, Cisco, Match Group, PornHub, Vimeo, Rockstar Games, McGraw Hill, the 7-Eleven store chain, the cruise operator Carnival, Udemy and the medical device manufacturer Medtronic. Against this backdrop, the breach at a workwear maker looks like just another episode in a long-running series.

Source: Bleeping Computer