The Register reports:
Workwear and fashion retailer Carhartt’s data breach was about half as bad as ShinyHunters claimed, according to Troy Hunt, who reviewed the data dump before uploading it to his Have I Been Pwned website.
Hunt’s HIBP service reported 12.9 million individuals affected by the alleged breach, around half of what ShinyHunters purported when it claimed to leak the company’s data earlier this month.
ShinyHunters dumped what it said was 50GB worth of Carhartt’s data on August 13 after the retailer hired what the criminals called “a very unskilled and incompetent negotiator” to haggle the crooks down from their $3.3 million extortion demand.
According to Hunt, ShinyHunters data was injected with millions of lines of synthetic data, substantially padding out the number of affected individuals.
Read more at The Register.
Neither Troy Hunt of Have I Been Pwned nor The Register go so far as to outright accuse ShinyHunters of adding fake data so that they could claim millions more were affected as part of their attempt to extort Carhartt.