Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Carhartt, Inc.

carhartt.com

Discovered 2026-08-14 05:59 UTC
Est. attack date 2026-08-13
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

Our demand for this Company was $3.3 million. The Company reached out. However, The Company did not try to negotiate. If The Company attempted to negotiate with us The Company would've ended up saving a good chunk of money. Instead they decided to do (see blow); this is also because The Company hired a very unskilled and incompetent negotiator. If The Company hired competency to negotiate for them, this post would've never been published. [21:24:22] carhartt: After careful review and internal discussions with leadership, we have decided not to move forward with negotiations or further discussions. We appreciate your patience throughout this process. There is millions of customers of data involved here. As we always say, these companies don't care. Millions of records of customer data and vast amount of sensitive information and PII containing employee, customer, customer metadata (royalty info), and other internal corporate data was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. | Size: 50GB+ (compressed) | Updated: 13 August 2026 | SHA256: 6b37f770382ce82bfa4677466cc51d9269e5a70436eecf101fae6fa9d5d8e8ac

Infostealer activity detected by HudsonRock

Compromised Employees: 12

Compromised Users: 1557

Third Party Employee Credentials: 16


External Attack Surface: 112


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • carharttdomainscarhartt.com
  • whoisrequestmarkmonitor.com
  • abusecomplaintsmarkmonitor.com
MX Records
  • mxa-003f2d01.gslb.pphosted.com. Proofpoint
  • mxb-003f2d01.gslb.pphosted.com. Proofpoint
TXT Records
  • successfactors-site-verification=ZTgzOTRmMDU5NGM5MTU3ZDc2ODllYTQ0NTJiNDgzZTgxMDhmNjkxMGNhZDA2NDVkY2FhNDQ1YTMxNTBkNzFhNg==
  • v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all
  • 00DHr00000FdlC7=1TBS700000002qW
  • pardot1097562=5ced8ec21e7158fabbc2464e29e5b7c62ef60bb2160975e77fb14ceb5987f530
  • ibmid=71ccd0fe-0742-4cf1-b96a-81db6082b6bf
  • mandrill_verify.lWiK3Se7JE7IqUB5PXy69A
  • smartsheet-site-validation=3-zGwjxTwGLkTshmnG0z6KsIt4qLeLzT
  • miro-verification=924f9b75683619955b3ba3079ab4a975306a3766
  • google-site-verification=Svn4qqYmuCSflIBw_R-rwHU5ID7DihlGrFAIT8A7wfM
Cloud / SaaS Services Detected
Mailchimp Miro Proofpoint Salesforce SAP Success Factor Smartsheet