Carnival Data Breach Exposed 6 Million People
Carnival Corporation confirms 6 million customer records stolen via social engineering attack claimed by ShinyHunters.
Run Carnival Corporation?
Get an email when a reviewed story names Carnival Corporation, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Carnival Corporation notified approximately 6 million individuals of a data breach discovered on April 14, after hackers used social engineering to compromise an employee account and access company systems. The stolen data includes names, addresses, dates of birth, email addresses, phone numbers, and government-issued ID numbers. The extortion group ShinyHunters claimed responsibility and publicly leaked 8.7 million records in late April, with roughly 7.5 million accounts from Carnival's Holland America Mariner Society loyalty program confirmed affected.
The lesson from this incident
Full lessonCarnival Corporation suffered a massive data breach when attackers used social engineering tactics to compromise an employee's account credentials, gaining unauthorized access to company systems containing 6 million customer records. The incident highlights how human vulnerabilities can bypass technical security controls, as employees remain the weakest link in cybersecurity defenses. The breach exposed highly sensitive personal information including government-issued ID numbers, demonstrating the cascading impact when privileged accounts are compromised. The subsequent public leak by ShinyHunters extortion group shows how data breaches can escalate beyond initial theft to public exposure and reputational damage.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.