Breaches and incidentsBriefReported by a reputable outlet, citing the company
Carnival Corporation: 5,995,277 people notified after an employee was socially engineered
Carnival’s Maine filing: 5,995,277 people.
- Disclosed
What happened
- Carnival’s Maine filing: 5,995,277 people. Data includes names, birth dates, gender, email addresses and Holland America Mariner Society loyalty status (other reports add addresses, phone numbers and government identifiers). Detected 14 Apr 2026.
- Root cause per Carnival’s letters: an attacker “used social engineering to deceive an employee” to reach a limited part of its IT system.
- ShinyHunters listed Carnival on 18 Apr claiming 8.7 million records; HIBP found about 7.5 million unique emails in the leak.
- Notices from 27 May with two years of TransUnion monitoring; several lawsuits filed.
Sources
- https://www.helpnetsecurity.com/2026/05/28/carnival-corporation-data-breach/
- https://www.malwarebytes.com/blog/data-breaches/2026/05/carnival-confirms-data-breach-impacting-nearly-6-million
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.