Carnival Says Data Breach Affected Nearly 6 Million People
Summary
Carnival says attackers used social engineering to access an employee account and steal files containing personal information. The company reported 5,995,277 affected people; ShinyHunters separately claimed 8.7 million records and published data.
Key points
- Carnival said it identified the incident on April 14 after attackers gained access to an employee account through social engineering.
- Using that account, attackers accessed company systems and exfiltrated files containing personal information.
- Carnival told Maine authorities that 5,995,277 people were affected; the information potentially included names, contact details, birth dates and government-issued ID numbers.
- Carnival is offering affected individuals 24 months of free credit monitoring.
- ShinyHunters claimed to have stolen 8.7 million records and made data publicly available in late April; that group’s claim is distinct from Carnival’s reported findings.
- Have I Been Pwned analyzed the leaked dataset and estimated that roughly 7.5 million accounts associated with Holland America’s Mariner Society were likely affected.
Article Details
- Victim Organization
- Carnival Corporation
- Incident Type
- Data breach involving social engineering to access an employee account, followed by access to company systems and exfiltration of files containing personal information.
- Data Types Exposed
- Names
- Addresses
- Dates of birth
- Email addresses
- Phone numbers
- Government-issued ID numbers
- Gender
- Geographic locations
- Loyalty program details
- Affected Records
- Carnival reported that 5,995,277 people were affected. ShinyHunters claimed 8.7 million records were stolen. HaveIBeenPwned reported that roughly 7.5 million accounts related to Holland America's Mariner Society loyalty program were likely affected.
- Operational Impact
- Carnival said it was providing affected individuals with 24 months of free credit monitoring.
- Ransom Or Extortion
- ShinyHunters, described as an extortion group, claimed the theft and reportedly made the data publicly available in late April. The article does not report a ransom demand.
- Claim Status
- confirmed