Carnival

Disclosed Apr 24, 20265,995,277 affectedConfirmed

Carnival confirms social engineering breach exposing 5,995,277 customers

Carnival told the Maine AG that an actor deceived an employee to access part of its IT system, exposing names, birth dates, emails, locations and loyalty data of 5,995,277 customers. ShinyHunters had claimed 8.7 million records in April.

What is known

People affected	5,995,277 (as reported by the organization)
Disclosed	Apr 24, 2026
Discovered	Apr 14, 2026
Happened	Apr 10, 2026
Attack	Phishing
Data exposed	NamesGovernment IDsDates of birthEmailsLocationOtherAddresses
Sector	Hospitality · US
Status	Confirmed
Check your email	Have I Been Pwned

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Carnival

Official noticeatg.wa.gov

Washington Attorney General breach notice: Carnival

Official noticeattorneygeneral.delaware.gov

Notice letter filed with the Delaware DOJ: Carnival

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Carnival

The organizationapi.kscope.io

Carnival disclosure

Aggregatorhaveibeenpwned.com

Have I Been Pwned: Carnival

Newsbleepingcomputer.com

Carnival Cruise confirms data breach affecting nearly 6 million people

Regulatormaine.gov

Maine AG breach notice: Carnival Corporation

Official noticeoag.my.site.com

Texas Attorney General data security breach report BR-0005069: Carnival

Official noticeago.vermont.gov

Vermont Attorney General breach report: Carnival

Official noticein.gov

Indiana Attorney General 2026 data breach report: Carnival

Notices filed

Accounts in the dataApr 24

Have I Been Pwned7,531,359 people

Residents of CAMay 27

California AGCount not stated

Residents of WAMay 27

Washington AG54,960 people

Residents of DEMay 27

Delaware DOJ17,876 people

Residents of ORMay 27

Oregon DOJ5,995,277 people

Residents of INMay 27

Indiana AG85,084 people

TotalMay 28

Research5,995,277 people

Residents of TXMay 28

Texas AG800,060 people

Residents of VTMay 28

Vermont AG3,915 people

Other breaches at Carnival

Breach, details not statedExposed names, government IDs and health records. Reported to the Delaware DOJ.38K affectedUSMar 2, 2020

History of this record

source2026-09-25

empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-7_2026.pdfby backfillSource

source2026-09-25

empty to https://ago.vermont.gov/categories/security-breach-noticesby backfillSource

data_types2026-09-25

["names","government-id","dob","emails","location","other"] to ["names","government-id","dob","emails","location","other","addresses"]by backfillSource

sector2026-09-25

tech to hospitalityby seedSource

attack2026-09-25

hacking to phishingby seedSource

data_types2026-09-25

["names","government-id","dob","emails","location"] to ["names","government-id","dob","emails","location","other"]by seedSource

records2026-09-25

5200000 to 5995277by seedSource

summary2026-09-25

In April 2026, the notorious hacking collective ShinyHunters claimed they had obtained a substantial volume of data belonging to the Carnival cruise operator and attempted to extort the organisation to prevent the data from being leaked. Th to Carnival told the Maine AG that an actor deceived an employee to access part of its IT system, exposing names, birth dates, emails, locations and loyalty data of 5,995,277 customers. ShinyHunters had claimed 8.7 million records in April.by seedSource

title2026-09-25

empty to Carnival confirms social engineering breach exposing 5,995,277 customersby seedSource

hibp2026-09-25

empty to Carnivalby backfillSource

sector2026-09-25

other to techby backfillSource

data_types2026-09-25

["names","government-id"] to ["names","government-id","dob","emails","location"]by backfillSource

disclosed2026-09-25

2026-05-27 to 2026-04-24by backfillSource

summary2026-09-25

empty to In April 2026, the notorious hacking collective ShinyHunters claimed they had obtained a substantial volume of data belonging to the Carnival cruise operator and attempted to extort the organisation to prevent the data from being leaked. Thby backfillSource

data_types2026-09-25

[] to ["names","government-id"]by backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 5200000by backfillSource

attack2026-09-25

unknown to hackingby backfillSource

discovered2026-09-25

empty to 2026-04-14by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Carnival