Carhartt data breach lawsuit: what it claims and who could get paid

What happened in the Carhartt data breach

ShinyHunters, an extortion group, claimed on or around August 13, 2026 that it had hacked Carhartt and taken more than 50GB of documents covering customers, employees and the company. The group said it demanded a $3.3 million ransom, that Carhartt chose not to negotiate, and that it then published an archive. Those are the attackers' claims.

Have I Been Pwned, the breach-tracking service, added the data on August 25, 2026. It counts about 12.9 million unique email addresses, with names, phone numbers and physical addresses, after removing millions of synthetic records that didn't belong to real people. BleepingComputer reported on August 27, 2026 that more than 15,000 addresses in the data used Carhartt's own email domain, which suggests employee records are included, and that Carhartt had not confirmed the claims or issued a statement. Top Class Actions' October 4, 2026 report on one of the lawsuits mentions no Carhartt response, and we found no copy of a notice letter.

What the Carhartt data breach lawsuits claim

Three proposed class actions were filed in the Eastern District of Michigan within about ten days. Barber et al. v. Carhartt, Inc. (filed September 2, 2026) accuses Carhartt of negligence, negligence per se, breach of contract, breach of implied contract and unjust enrichment, says Carhartt gave no notice to the people affected, and asks for damages, court-ordered security changes and at least three years of credit monitoring. Kempf v. Carhartt, Inc. (filed September 3) is brought by an Illinois man who bought from Carhartt's website; it alleges negligence, breach of implied contract and unjust enrichment, says Carhartt skipped required encryption protocols even for internal data, and asks for damages and declaratory and injunctive relief. Sebastian v. Carhartt, Inc. (filed September 11) makes similar claims, according to Top Class Actions' summary.

These are allegations, not findings, and no court has ruled. Owed tracks the litigation on its Carhartt page. For the mechanics, see how a class action lawsuit works.

Who could be in the class

No class has been certified, so nobody is formally a class member yet. Kempf proposes a nationwide class of everyone whose private information Carhartt maintained and that was compromised in the breach. Barber's proposed class is everyone whose information was compromised beginning in August 2026. Because the leaked fields are email addresses, names, phone numbers and physical addresses, that could cover customers and, given the 15,000-plus Carhartt addresses in the data, some employees. Who is actually covered will depend on how a judge defines any class and on what Carhartt's records show.

To see whether your email appears in the leak, you can look it up on Have I Been Pwned. A match means your data was in the published archive; it doesn't mean you qualify for money. Our guide, a brand you bought got sued, explains what customers can and can't do.

Where the case stands

The cases are at the earliest stage. The Barber docket shows Carhartt was served on September 4, 2026, with an answer originally due September 25, and a stipulation and order setting deadlines entered that same day. It also has a "Consolidate Cases" entry dated September 30, while the Sebastian and Kempf dockets show reassignment entries on September 23 and October 5. The docket labels don't reveal the orders' text, but together they point to the three suits heading before one judge. We saw no ruling on the claims or on class status, and no settlement.

What usually follows is a combined complaint, court-appointed lead lawyers, and a motion from Carhartt to dismiss some or all claims. Those steps take months. Our guide on what happens after a class action is certified covers the road to payment.

Could anyone get paid from the Carhartt lawsuits?

Not today. There is no settlement, no fund, no claim form and no deadline. The complaints ask for damages, but that describes what plaintiffs want, not what anyone will receive. If the cases end in a settlement, data breach payments range from small flat amounts to reimbursement of documented losses; our data breach settlement guide explains how they pay.

Be wary of any site, text or email offering a Carhartt payout or asking for a fee. With no claim process, such offers are not from the court. Our guide to spotting settlement scams lists the red flags.

What you can do now

The listed fields are email addresses, names, phone numbers and physical addresses, so the main risk is convincing phishing that uses your real details. Treat unexpected messages about Carhartt orders, refunds or a "settlement" with suspicion, and go to a company's site yourself instead of tapping a link. The leak's listed fields don't include passwords, but if you reuse a password from a Carhartt account elsewhere, changing it is cheap insurance. If you are a Carhartt employee, ask your employer what it knows, and watch your mail and email for any official notice.

How to hear if Carhartt settles

If a settlement is announced, a court-approved notice would go to people the administrator can identify, and a settlement website would open. Until then, you can follow the cases on CourtListener, which offers docket alerts, and read how to get notified of class action settlements.

Owed can keep the dates straight: it finds settlements you may qualify for, explains each one in plain English, opens the official claim form, reminds you before deadlines and tracks your claim to payout, while you submit the claim yourself. Owed Pro is $2 for the first week, then $49 per year — one flat membership. Owed never takes a percentage of any payout. See our Carhartt page, check what you qualify for, or browse the open settlements directory.

This is general information, not legal advice. Owed isn't a law firm; the court decides who is in any class and whether anyone is paid.

Glossary

ShinyHunters

A cybercriminal extortion group that has claimed attacks on many companies. It said it stole and then published the Carhartt data.

Proposed class

A group that plaintiffs ask the court to certify. Until the judge certifies it, nobody is formally a member and no money is owed.

Consolidation

Combining related lawsuits into one case before one judge, usually with court-appointed lead lawyers.

Synthetic records

Made-up entries that do not belong to real people. Have I Been Pwned removed millions of them before counting the 12.9 million email addresses.

Motion to dismiss

A request that asks the judge to throw out some or all claims early, before evidence is exchanged.

FAQ