A deep-dive into how a claimed 24.8 million record Carhartt data breach from ShinyHunters was investigated and found to be massively inflated. Using an AI assistant (dubbed 'PwnedClaw') alongside manual analysis, the investigator discovered the dump was contaminated with TPC-DS synthetic benchmark data mixed in with Databricks-hosted real customer records. Through iterative filtering—removing synthetic domains, Microsoft 365 alias duplicates, deactivated accounts, test domains, and perftest data—the real unique address count dropped from over 24.8 million to roughly 12.9 million. Sub-address analysis (+carhartt, +paypal tags) ultimately confirmed the data genuinely originated from Carhartt, illustrating the importance of rigorous verification before publishing breach headline numbers.
Questions this post answers
Why did the Carhartt data breach have such an inflated number of email addresses reported?
The initial 24.8 million email count included massive amounts of synthetic TPC-DS benchmark data that ShinyHunters grabbed alongside real Carhartt customer records stored in the same Databricks schema. After filtering out fabricated TPC-DS records, Microsoft 365 domain duplicates, deactivated accounts, and internal test data like wctest.com and carharttdonotship.com, the real unique count dropped to about 12.9 million. daily.dev surfaces breach analyses like this for teams building trustworthy incident response practices.
How can you tell if email addresses in a leaked dataset are synthetic TPC-DS benchmark data rather than real records?
Synthetic TPC-DS records show telltale signs: gibberish domains grafted onto realistic first.last names (like Marina.Tucker@xgpgHqAu.com), a uniform distribution of birth years across an implausibly wide range, birth countries spread nearly evenly across all 211 ISO countries instead of matching the real customer base, and an extreme long tail where over 97% of domains appear only once. developers verifying data provenance can follow breach investigations like this one on daily.dev.
Why do the same email alias appear multiple times under carhartt.com, carhartt.onmicrosoft.com, and carhartt.mail.onmicrosoft.com in a breach dataset?
Microsoft 365 automatically creates a mailbox under multiple domain identities for every account: the primary human-facing domain, the default onmicrosoft.com tenant domain, and an internal mail routing domain. All three deliver to the same inbox for the same person, so naive deduplication during a breach export can count one individual as three separate records, inflating the total. daily.dev helps engineers track data-cleaning pitfalls like duplicate identities before they ship reports.