Carnival
Disclosed Apr 24, 20265 months ago5,995,277 affectedConfirmed
Carnival confirms social engineering breach exposing 5,995,277 customers
Carnival told the Maine AG that an actor deceived an employee to access part of its IT system, exposing names, birth dates, emails, locations and loyalty data of 5,995,277 customers. ShinyHunters had claimed 8.7 million records in April.
What is known
| People affected | 5,995,277 (as reported by the organization) |
|---|---|
| Disclosed | Apr 24, 2026 |
| Discovered | Apr 14, 2026 |
| Happened | Apr 10, 2026 |
| Attack | Phishing |
| Data exposed | Names, Government IDs, Dates of birth, Emails, Location, Other, Addresses |
| Sector | Hospitality · US |
| Status | Confirmed |
| Check your email | Have I Been Pwned |
Sources
Notices filed
| Where | Filed | People |
|---|---|---|
| Have I Been Pwnedaccounts in the data | Apr 24 | 7,531,359 |
| California AGresidents of CA | May 27 | |
| Washington AGresidents of WA | May 27 | 54,960 |
| Delaware DOJresidents of DE | May 27 | 17,876 |
| Oregon DOJresidents of OR | May 27 | 5,995,277 |
| Indiana AGresidents of IN | May 27 | 85,084 |
| Researchtotal | May 28 | 5,995,277 |
| Texas AGresidents of TX | May 28 | 800,060 |
| Vermont AGresidents of VT | May 28 | 3,915 |
Other breaches at Carnival
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Mar 2, 2020Mar 2, 20206 years ago | Mar 2, 20206 years ago | Not stated | Other | Confirmed | 38K |
History of this record
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-7_2026.pdf · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/categories/security-breach-notices · backfill source
- 2026-09-25 · data_types: ["names","government-id","dob","emails","location","other"] to ["names","government-id","dob","emails","location","other","addresses"] · backfill source
- 2026-09-25 · sector: tech to hospitality · seed source
- 2026-09-25 · attack: hacking to phishing · seed source
- 2026-09-25 · data_types: ["names","government-id","dob","emails","location"] to ["names","government-id","dob","emails","location","other"] · seed source
- 2026-09-25 · records: 5200000 to 5995277 · seed source
- 2026-09-25 · summary: In April 2026, the notorious hacking collective ShinyHunters claimed they had obtained a substantial volume of data belonging to the Carnival cruise operator and attempted to extort the organisation to prevent the data from being leaked. Th to Carnival told the Maine AG that an actor deceived an employee to access part of its IT system, exposing names, birth dates, emails, locations and loyalty data of 5,995,277 customers. ShinyHunters had claimed 8.7 million records in April. · seed source
- 2026-09-25 · title: empty to Carnival confirms social engineering breach exposing 5,995,277 customers · seed source
- 2026-09-25 · hibp: empty to Carnival · backfill source
- 2026-09-25 · sector: other to tech · backfill source
- 2026-09-25 · data_types: ["names","government-id"] to ["names","government-id","dob","emails","location"] · backfill source
- 2026-09-25 · disclosed: 2026-05-27 to 2026-04-24 · backfill source
- 2026-09-25 · summary: empty to In April 2026, the notorious hacking collective ShinyHunters claimed they had obtained a substantial volume of data belonging to the Carnival cruise operator and attempted to extort the organisation to prevent the data from being leaked. Th · backfill source
- 2026-09-25 · data_types: [] to ["names","government-id"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 5200000 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2026-04-14 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.