The past seven days delivered a reminder that breach exposure now comes from three directions at once: retail platforms holding customer loyalty data, developers who mishandle payment-processor credentials, and third-party software vendors serving hospitals and other institutions. A major apparel retailer, a wave of leaked payment API keys tied to North American merchants, and a Toronto children's hospital all disclosed incidents this week, each illustrating a different failure point that individuals and business owners need to understand.

Carhartt Data Breach Exposes Millions of Accounts

American workwear retailer Carhartt was hit by the extortion group ShinyHunters, who dumped what it said was 50GB worth of Carhartt's data on August 13 after the retailer hired what the criminals called "a very unskilled and incompetent negotiator" to haggle the crooks down from their $3.3 million extortion demand. Independent analysis by breach-notification service Have I Been Pwned found the real scope was smaller than claimed, but still significant: the data breach affects more than 12.9 million Carhartt accounts, with the exposed information including unique email addresses, names, phone numbers, and physical addresses, as well as millions of synthetic records that did not relate to real individuals. Investigators linked the resulting data breach to the compromise of Carhartt's Databricks analytics platform, a cloud-based data platform that combines standard business reporting and data storage. Notably, the researcher also found over 15,000 employees with @carhartt.com email addresses in the leaked data, meaning this is both a customer and workforce exposure event. The lesson for businesses: analytics and data-warehouse platforms are now prime targets, not just production databases, and they deserve the same access controls and monitoring.

Live Stripe API Keys Expose North American Merchants

Separately, researchers documented a large-scale exposure of payment-processing credentials. A dataset published on a data-trading forum on 18 August 2026 contains live Stripe API keys for 659 merchant accounts, along with roughly 35 GB of customer and payment data pulled from them. Critically, the incident does not indicate that Stripe's systems were breached — the keys were harvested directly from merchants through public code repositories, infostealer malware, and misconfigured servers. Geographically, United States 212, United Kingdom 81, France 57, Canada 38, Brazil 30, Australia 27 merchant accounts were affected, making this a direct North American business exposure. A live secret key is not a low-stakes credential: it is full programmatic access to the account — anyone holding one can read every customer record, create charges, issue refunds, and change where payouts are sent. Separately, researchers communicated with the seller, who said the published dump was only a fraction of the stolen data and claimed to possess about 20,000 compromised Stripe API keys, suggesting more disclosures are likely.

Ransomware and Healthcare: SickKids and the SonicWall Wave

Toronto's Hospital for Sick Children disclosed that a cybersecurity incident exposed the personal information of some current and former employees and job applicants, stemming from a flaw in third-party software, though clinical systems and patient records were not affected. This tracks a broader pattern: ransomware group INC has claimed 885 victims to date, with the most recent victim listed on August 2, 2026, largely by exploiting SonicWall vulnerabilities that could be chained to facilitate arbitrary command execution and take over susceptible devices. Third-party software and edge devices remain the weakest link for institutions holding sensitive personal data.

What Individuals Should Do This Week

  • Check your email against breach databases and change reused passwords, especially if you've ever shopped at Carhartt or used services tied to the affected merchants.
  • Watch for highly targeted phishing referencing loyalty program details, order history, or employer names — this is exactly the kind of contextual data now circulating from retail breaches.
  • Enable multi-factor authentication on financial and email accounts; credential-stuffing attempts typically follow breach disclosures within days.

What Businesses Should Do This Week

  • Audit code repositories, CI/CD logs, and configuration files for hardcoded API keys or secrets — this was the root cause of the Stripe merchant exposure, not a Stripe platform failure.
  • Rotate payment-processor keys on a schedule and use restricted-scope keys wherever full account access isn't required.
  • Patch internet-facing appliances immediately, particularly SonicWall SMA devices, given active exploitation by ransomware operators.
  • Extend security reviews to analytics and data-warehouse platforms, not just production systems — the Carhartt breach originated in a business intelligence environment.
A Stripe secret key is not a password to a dashboard. It is full programmatic access to the account.

None of this week's incidents required a novel exploit against a major platform — they exploited process gaps: unmonitored analytics tools, careless key management, and unpatched edge devices. That pattern is the real story for both individuals and businesses heading into September.