Carnival Confirms Data Breach Affecting Nearly 6 Million People
Summary
Carnival says a social engineering attack led to unauthorized access and the theft of personal information affecting 5,995,277 people. ShinyHunters claimed responsibility, but Carnival has not attributed the breach.
Key points
- Carnival said an unauthorized actor used social engineering to deceive an employee and access a limited portion of its IT systems.
- The company identified unauthorized activity involving an employee account on April 14, 2026, and determined on April 22 that personal information had been copied.
- Carnival began notifying 5,995,277 affected people about the breach.
- Have I Been Pwned's analysis of data leaked by ShinyHunters indicated exposed information included names, dates of birth, email addresses, genders, locations, and loyalty-program details.
- ShinyHunters claimed the breach in April, but Carnival has not attributed the attack or confirmed the group's claim.
Article Details
- Victim Organization
- Carnival Corporation
- Incident Type
- Social engineering of an employee to gain unauthorized access to a limited portion of Carnival's IT systems, followed by copying personal information.
- Incident Date
- 2026-04-10
- Data Types Exposed
- Names
- Dates of birth
- Email addresses
- Genders
- Geographic locations
- Loyalty program details
- Affected Records
- Carnival said it began notifying 5,995,277 customers. ShinyHunters claimed the stolen documents contained over 8.7 million records; Carnival has not confirmed that figure.
- Affected Data Size
- ShinyHunters claimed to have stolen terabytes of internal corporate data; this was not confirmed by Carnival.
- Operational Impact
- An unauthorized actor accessed a limited portion of Carnival's IT system using an employee account. Carnival said it blocked the activity and began an investigation; no broader operational disruption was reported.
- Ransom Or Extortion
- ShinyHunters claimed responsibility and reportedly listed Carnival on its leak site. Carnival has not attributed the attack to the group. The article does not report a specific ransom demand to Carnival.
- Claim Status
- confirmed