Troy Hunt Cuts Carhartt Breach Count to 12.9 Million After Finding Synthetic Benchmark Data in the Dump

When the ShinyHunters extortion group published data it claimed to have stolen from workwear maker Carhartt, the dump contained nearly 25 million unique email addresses. After working through the data, Have I Been Pwned founder Troy Hunt put the real number at about 12.9 million, roughly half the headline figure. His write-up is a useful lesson in how breach numbers get inflated.

Synthetic data in the dump

ShinyHunters’ claim surfaced around Aug. 13. Hunt’s open source Email Address Extractor first counted 24,876,077 addresses, and at least one outlet reported a similar figure. Then Hunt, working with an AI assistant on the OpenClaw platform, found that the files came from a Databricks environment and followed the TPC-DS schema, a standard retail analytics benchmark. The data showed telltale anomalies:

• About 4 million .edu and 3.9 million .org addresses, far too many for a retail brand, many on random-looking domains.
• Birth years spread evenly across a 69-year range with hard cutoffs, which real customer data wouldn’t show.
• A firstname.lastname pattern in 50.4% of addresses, versus the 10% to 15% Hunt’s analysis expected in real retail data.

Hunt concluded that this was a real Carhartt Databricks breach, but TPC-DS benchmark data sat in the same schema, and ShinyHunters “and every aggregator after them” grabbed all of it without realizing. Signs of real data included addresses on a Carhartt domain apparently used to flag accounts the company won’t ship to, and a 70% HIBP hit rate on free email addresses. He also removed test-domain addresses and deactivated aliases before loading the breach.

Why it matters

HIBP loaded 12.9 million unique addresses, 83% of which were already in its database. Hunt warns that loading everything would have made the incident look about twice as bad as it was, and that inflated numbers lead to unfair reporting on victim organizations. For security teams and journalists, the advice is to treat headline breach figures with caution until someone has actually examined the data.