Troy Hunt said Carhartt’s data breach affects about 12.9 million people, roughly half the number ShinyHunters claimed when it dumped the retailer’s data on August 13. He reviewed the leak with AI-assisted analysis and human checks before posting it to Have I Been Pwned.
The important part is the correction: the attacker’s headline count was inflated, but the verified dataset is still large enough to matter for customer exposure, notification, and fraud monitoring. The scale change does not erase the leak; it changes the number teams should use when they talk about who was affected.
For Carhartt and other retailers watching breach claims, the lesson is that public extortion counts are not ground truth. The operational number is the one that should drive customer support and downstream fraud planning, even when the leak-site story is louder.