Carnival Confirms April Data Breach That May Affect Nearly 6 Million People
Summary
Carnival confirmed an April cyberattack in which an attacker copied personal data after compromising an employee account. A Maine filing suggests nearly 6 million people may be affected; Carnival has not attributed the attack to ShinyHunters.
Key points
- Carnival said an attacker accessed a limited part of its IT environment after compromising an employee account and copied personal information by the end of April.
- Exposed data varied by person and included names, contact details, dates of birth, driver’s license numbers, and passport numbers.
- Carnival did not disclose the number affected; a filing with Maine’s attorney general suggests nearly 6 million people may be affected.
- ShinyHunters claimed it stole Carnival data and later released what it said were 8.7 million records, including records allegedly linked to Holland America Line’s Mariner Society.
- Carnival said it blocked the unauthorized activity, engaged third-party security experts, and began an investigation.
- Carnival has not publicly attributed the attack to ShinyHunters.
Article Details
- Victim Organization
- Carnival
- Incident Type
- Cyberattack involving compromised employee-account access and theft of personal information
- Data Types Exposed
- Names
- Addresses
- Email addresses
- Phone numbers
- Dates of birth
- Driver’s license numbers
- Passport numbers
- Affected Records
- A Maine filing indicates that nearly 6 million individuals may have been affected. ShinyHunters separately claimed to have released 8.7 million records.
- Operational Impact
- An attacker accessed a limited portion of Carnival’s IT environment through a compromised employee account and copied personal information. Carnival said it blocked the unauthorized activity and investigated; no operational disruption was reported.
- Ransom Or Extortion
- ShinyHunters claimed it obtained Carnival data and attempted to extort the company to prevent publication. The group later released records it claimed were Carnival data.
- Claim Status
- confirmed