ShinyHunters says failed negotiations with its latest victim – Carhartt – forced the extortion gang to publish millions of stolen records from the workwear giant, including customer and employee data.

Update 8/25: Have I Been Pwned has analyzed the leaked Carhartt data, identifying 12.9 million unique email addresses likely belonging to real users.

According to HIBP founder Troy Hunt, the original dataset was also found to contain nearly 12 million synthetic, test, disposable, and non-human addresses that he excluded from the final count.

HIBP says the exposed data includes names, phone numbers, physical addresses, and email addresses.

$3.3 million demand goes nowhere

The prolific hacker group posted Carhartt on its dark leak site Thursday, along with a download link to an alleged 50GB of stolen data.

Notably, the gang did not attach any proof samples to the Carhartt entry to show off its handiwork.

It's not clear exactly when the purported breach took place, but ShinyHunters is claiming Carhartt prematurely walked away from the negotiating table after refusing to pay a $3.3 million ransom.

To note, in the extensive data analysis posted on his personal website, Hunt said the breach appears to have occurred sometime in early August.

What’s more, the ransomware operators say they would have accepted the ransom deal at a lower price point if Carhartt’s negotiating team hadn’t been so "incompetent."

“Our demand for this Company was $3.3 million. The Company reached out. However, The Company did not try to negotiate,” ShinyHunters wrote, adding that Carhartt could have “ended up saving a good chunk of money” had it played ball.

The Company hired a very unskilled and incompetent negotiator. If The Company hired competency to negotiate for them, this post would've never been published,

ShinyHunters claims.

ShinyHunters posted an excerpt of the final message it claims to have had recieved from the nearly 140-year-old clothing company.

"After careful review and internal discussions with leadership, we have decided not to move forward with negotiations or further discussions. We appreciate your patience throughout this process,” Carhartt’s alleged response stated, effectively ending the ransom negotiations.

Customer and employee data allegedly stolen

Of course, whether ShinyHunters is just talking smack remains to be seen, but if the stolen 50GB claim is legitimate, data belonging to millions of Carhartt customers is now at risk.

Headquartered in Dearborn, Michigan, the private, family-owned workwear clothing and apparel brand generates close to $1 billion in annual revenue across retail stores, wholesale distribution, and online sales.

According to its website, Carhartt owns and operates 70 U.S.-based brick-and-mortar stores, as well as another 100 retail locations in major cities across Europe, Asia, and North America under its lifestyle and streetwear spin-off, Carhartt WIP.

The company says it employs more than 3,000 associates worldwide.

ShinyHunters describes the contents of the massive cache as millions of records of customer and employee personally identifiable information (PII) and sensitive data.

The group also says it has customer metadata (royalty information) and other internal corporate data, leaving out specific details about what that data may be.

There are “millions of customers' data involved here. As we always say, these companies don't care," ShinyHunters posted.

Once stolen by hackers, exposed personal data could lead to future targeted phishing scams and identity theft.

Cybernews has reached out to Carhartt and is waiting for a response at the time of this report.