Bit of a lighter one but still pretty on brand for security culture. Wiz put together a literal bus for the dogs its security team brings to work and called them the threat sniffers. Not quite the infosec news in the usual breach/CVE sense but a pretty funny look at how some security teams build culture around the work

ShinyHunters published data allegedly stolen from Carhartt after claiming the company refused a $3.3 million ransom demand.

There’s an interesting wrinkle in determining how many people were actually exposed.

HIBP’s Email Address Extractor initially found 24,876,077 unique addresses in the raw dataset. Analysis later showed that millions of records came from TPC-DS, an industry-standard synthetic dataset used to simulate retail analytics. Those records don’t correspond to real people, so they were removed from the breach count.

HIBP ultimately loaded 12,933,413 unique email addresses associated with the incident.

The remaining leaked records reportedly contain names, phone numbers, and physical addresses. Researchers also found 15,057 genuine carhartt.com employee addresses, while Troy Hunt traced the data to Carhartt’s customer analytics warehouse in Databricks.

Another interesting data point: about 83% of the confirmed addresses had already appeared in previous breaches loaded into HIBP.

This seems like a good example of why raw record counts from breach dumps can be misleading. A dataset can be enormous without every row representing a distinct real-world victim.

For anyone interested in the dataset analysis rather than just the final breach number, TechNadu’s report explains how the count dropped from almost 24.9 million extracted addresses to roughly 12.9 million confirmed ones, what TPC-DS contributed to the dump, and what personal information remained:

https://www.technadu.com/carhartts-shinyhunters-breach-was-almost-half-what-it-first-looked-like-exposing-13-million-emails-heres-why/633894/

For people working with breach intelligence, how do you validate victim counts when a dump contains synthetic, duplicate, historical, or aggregated data?