--- title: A Cautionary Tale About Data Breach Claims, Verification... description: A deep-dive into how a claimed 24.8 million record Carhartt data breach from ShinyHunters was investigated and found to be massively inflated. Using an AI... canonical: https://daily.dev/posts/a-cautionary-tale-about-data-breach-claims-verification-and-carhartt-epfbpocwu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A Cautionary Tale About Data Breach Claims, Verification and Carhartt | daily.dev og:description: A deep-dive into how a claimed 24.8 million record Carhartt data breach from ShinyHunters was investigated and found to be massively inflated. Using an AI... og:url: https://daily.dev/posts/a-cautionary-tale-about-data-breach-claims-verification-and-carhartt-epfbpocwu og:image: https://api.daily.dev/og/posts/EpfbPocWU.png og:image:alt: A Cautionary Tale About Data Breach Claims, Verification and Carhartt og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A Cautionary Tale About Data Breach Claims, Verification and Carhartt **[Troy Hunt](https://daily.dev/sources/troyhunt)** · 21 min read · 1 upvotes · 0 comments ## Summary A deep-dive into how a claimed 24.8 million record Carhartt data breach from ShinyHunters was investigated and found to be massively inflated. Using an AI assistant (dubbed 'PwnedClaw') alongside manual analysis, the investigator discovered the dump was contaminated with TPC-DS synthetic benchmark data mixed in with Databricks-hosted real customer records. Through iterative filtering—removing synthetic domains, Microsoft 365 alias duplicates, deactivated accounts, test domains, and perftest data—the real unique address count dropped from over 24.8 million to roughly 12.9 million. Sub-address analysis (+carhartt, +paypal tags) ultimately confirmed the data genuinely originated from Carhartt, illustrating the importance of rigorous verification before publishing breach headline numbers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did the Carhartt data breach have such an inflated number of exposed email addresses reported initially? The initial figure of roughly 24.8 million unique email addresses was inflated because ShinyHunters' Databricks dump contained TPC-DS synthetic benchmark data co-located with real customer records in the same schema. After identifying and removing files with gibberish domains, uniform birth-year and birth-country distributions, and other synthetic markers, the genuine count dropped to about 13 million, and after further deduplication of Microsoft 365 domain variants, deactivated accounts, and internal test data, the final verified figure was roughly 12.9 million. _Anyone tracking real breach exposure numbers can follow verified writeups like this on daily.dev before trusting a headline figure._ ### How can you tell if email addresses in a leaked dataset are synthetic test data rather than real customer records? Look for statistical anomalies: domains that appear only once across millions of rows (97.6% singleton domains in this case signaled synthetic generation), gibberish or implausibly short domain names attached to plausible first-last name patterns, perfectly uniform distributions of birth year or birth country across the whole possible range instead of a realistic skew, and known test-schema artifacts like TPC-DS table structures or test domains such as wctest.com. _Teams validating breach data before disclosure can compare detection techniques like these through daily.dev._ ### How do Microsoft 365 email domain variants cause duplicate counts in breach data? Microsoft 365 automatically creates a mailbox under three domain identities for every account: the company's primary domain (like carhartt.com), the default onmicrosoft.com domain, and an internal mail routing domain like mail.onmicrosoft.com. All three point to the same inbox and person, so if a breach export doesn't normalize and deduplicate on the primary domain, a single individual can be counted as three separate unique addresses, inflating the apparent breach size. _Developers handling deduplication logic for user data can dig into edge cases like this via daily.dev._ ## Similar posts on daily.dev - [Zara data breach exposed personal information of 197,000 people](https://daily.dev/posts/zara-data-breach-exposed-personal-information-of-197-000-people-v24mdsfne) · BleepingComputer · 0 upvotes · 0 comments - [Betterment breach scope pegged at 1.4M users](https://daily.dev/posts/betterment-breach-scope-pegged-at-1-4m-users-y8majqbox) · The Register · 0 upvotes · 0 comments - [Weekly Update 506](https://daily.dev/posts/weekly-update-506-mn7kmsi8o) · Troy Hunt · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/a-cautionary-tale-about-data-breach-claims-verification-and-carhartt-epfbpocwu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A Cautionary Tale About Data Breach Claims, Verification and Carhartt","url":"https://daily.dev/posts/a-cautionary-tale-about-data-breach-claims-verification-and-carhartt-epfbpocwu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-cautionary-tale-about-data-breach-claims-verification-and-carhartt-epfbpocwu"},"datePublished":"2026-08-25T23:10:04.210Z","dateModified":"2026-09-13T20:47:20.153Z","description":"A deep-dive into how a claimed 24.8 million record Carhartt data breach from ShinyHunters was investigated and found to be massively inflated. Using an AI...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a225398ec65fedd8ac17bd81fa76cdff?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a225398ec65fedd8ac17bd81fa76cdff?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Troy Hunt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Troy Hunt","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/1a2018d006574ab1aab3209737d77e2b","url":"https://daily.dev/sources/troyhunt"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-cautionary-tale-about-data-breach-claims-verification-and-carhartt-epfbpocwu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-breach","timeRequired":"PT21M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Troy Hunt","item":"https://daily.dev/sources/troyhunt"},{"@type":"ListItem","position":3,"name":"A Cautionary Tale About Data Breach Claims, Verification and Carhartt"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-cautionary-tale-about-data-breach-claims-verification-and-carhartt-epfbpocwu#faq","mainEntity":[{"@type":"Question","name":"Why did the Carhartt data breach have such an inflated number of exposed email addresses reported initially?","acceptedAnswer":{"@type":"Answer","text":"The initial figure of roughly 24.8 million unique email addresses was inflated because ShinyHunters' Databricks dump contained TPC-DS synthetic benchmark data co-located with real customer records in the same schema. After identifying and removing files with gibberish domains, uniform birth-year and birth-country distributions, and other synthetic markers, the genuine count dropped to about 13 million, and after further deduplication of Microsoft 365 domain variants, deactivated accounts, and internal test data, the final verified figure was roughly 12.9 million. Anyone tracking real breach exposure numbers can follow verified writeups like this on daily.dev before trusting a headline figure."}},{"@type":"Question","name":"How can you tell if email addresses in a leaked dataset are synthetic test data rather than real customer records?","acceptedAnswer":{"@type":"Answer","text":"Look for statistical anomalies: domains that appear only once across millions of rows (97.6% singleton domains in this case signaled synthetic generation), gibberish or implausibly short domain names attached to plausible first-last name patterns, perfectly uniform distributions of birth year or birth country across the whole possible range instead of a realistic skew, and known test-schema artifacts like TPC-DS table structures or test domains such as wctest.com. Teams validating breach data before disclosure can compare detection techniques like these through daily.dev."}},{"@type":"Question","name":"How do Microsoft 365 email domain variants cause duplicate counts in breach data?","acceptedAnswer":{"@type":"Answer","text":"Microsoft 365 automatically creates a mailbox under three domain identities for every account: the company's primary domain (like carhartt.com), the default onmicrosoft.com domain, and an internal mail routing domain like mail.onmicrosoft.com. All three point to the same inbox and person, so if a breach export doesn't normalize and deduplicate on the primary domain, a single individual can be counted as three separate unique addresses, inflating the apparent breach size. Developers handling deduplication logic for user data can dig into edge cases like this via daily.dev."}}]} ```