A Cautionary Tale About Data Breach Claims, Verification and Carhartt

This analysis examines a ShinyHunters Databricks dump claimed to be a Carhartt breach and demonstrates the published corpus is substantially contaminated by synthetic TPC-DS benchmark data and test records; after filtering gibberish domains, test/perf entries, deactivated aliases, and Microsoft tenant aliases, the working set of likely-real Carhartt customer email addresses is approximately 12.9M, with internal employee aliases and organization-specific domains providing strong provenance that the data came from Carhartt systems.