ShinyHunters confirms theft of 6 million Carnival customer records after April breach

Carnival kept quiet for six weeks. Now it has confirmed the obvious: ShinyHunters walked off with personal data belonging to nearly 6 million customers after an April breach, and the group had already been leaking it online.

The attack was swift. On April 14, Carnival's security team spotted something wrong with a single employee account. A social engineering call was all it took to get inside. By April 22, internal investigators confirmed the attacker had already copied the data and left.

What was stolen

The stolen records vary by individual but confirmed categories include names, home addresses, email addresses, phone numbers, dates of birth, driver's license numbers, and passport numbers. Carnival's filing with Maine's attorney general puts the affected count at just under 6 million. ShinyHunters listed 8.7 million records on its leak portal in late April, a figure that includes data tied to the Mariner Society loyalty program run by Holland America Line. Have I Been Pwned confirmed the dataset. Carnival declined to pay. The data went public.

A repeat offender with a repeat target

Carnival has been here before. A 2019 breach exposed data belonging to roughly 180,000 customers and employees and ended with a $1.25 million regulatory fine. A second incident followed in 2021. The company's notification letters for this breach went out on May 27, six weeks after the intrusion began.

ShinyHunters does not slow down. The group has torn through a string of major targets in 2026 alone, hitting companies with the same playbook each time: get in through a person, grab the data, demand payment, publish if ignored. The FBI flagged the pattern earlier this year after the group targeted companies through compromises of Salesforce environments. ADT and Mixpanel were hit in the same campaign window.

US residents confirmed as affected are being offered two years of complimentary credit monitoring through TransUnion. Carnival says it has strengthened security controls following the incident.