Carnival Data Breach Exposes Data of Nearly 6 Million Customers

Carnival Corporation disclosed a data breach affecting nearly 6 million customers after a social engineering attack compromised an employee’s account. The incident, confirmed by the ShinyHunters hacking group, resulted in the theft of personal data, including names, dates of birth, genders, email addresses, and loyalty program details from Holland America Line customers. The breach began on April 10, 2026, but unauthorized activity was not detected until April 14. Carnival launched an investigation and blocked further access, later confirming on April 22 that data had been exfiltrated. The company stated that threat actors accessed a limited portion of its IT systems through the compromised account. ShinyHunters claimed responsibility, asserting it stole over 8.7 million records and terabytes of corporate data. Analysis of leaked data revealed exposure of Mariner Society loyalty program information, including geographic locations and email addresses. Carnival’s notification to affected customers acknowledged the breach but provided no further details on the scope or impact of the stolen data. This incident follows multiple prior breaches in 2020, raising concerns about Carnival’s cybersecurity defenses. The company has not named the attackers or disclosed additional measures taken to prevent future breaches. ShinyHunters, known for targeting large corporations, has previously used similar social engineering tactics in other attacks.