Carnival Data Breach Exposes Data of Nearly 6 Million Customers

Carnival Corporation disclosed an April 2026 intrusion in which a social-engineering compromise of an employee account led to exfiltration of customer and corporate data; the company detected the activity on April 14 and confirmed data theft by April 22. ShinyHunters claimed responsibility, asserting 8.7 million records and terabytes of data were stolen, while Carnival reported notifying approximately 5.995 million affected customers and offering identity protection services; leaked fields reportedly include names, dates of birth, genders, email addresses, and loyalty program status.