Carnival Corporation Confirms Data Breach Affecting Nearly 6 Million After Social Engineering Attack

MIAMI (AP) — Carnival Corporation confirmed Wednesday that a cyberattack has compromised the personal information of nearly 6 million customers and employees, following an intrusion into its IT systems by the ShinyHunters extortion gang.

The breach, which was detected in April 2026, resulted from a social engineering campaign that successfully deceived a company employee into granting unauthorized access to internal networks. Carnival stated that threat actors exploited this access to exfiltrate sensitive data, though the cruise line did not specify the exact nature of the information taken.

Carnival Corporation, the world's largest cruise operator, operates a fleet of ships under brands including Carnival Cruise Line, Princess Cruises, Holland America Line, and Costa Cruises. The company serves millions of passengers annually across global routes. In a statement released Wednesday, the corporation acknowledged the incident and confirmed that it is working with cybersecurity experts and law enforcement to investigate the scope of the breach.

The ShinyHunters group, known for targeting large corporations with ransomware and data extortion demands, has claimed responsibility for the attack. The group typically threatens to publish stolen data unless a ransom is paid. Carnival has not disclosed whether any ransom was demanded or paid.

The compromised data may include names, addresses, email addresses, phone numbers, and dates of birth for customers and employees. Carnival stated that it is notifying affected individuals and has implemented additional security measures to prevent future incidents. The company also announced that it is offering credit monitoring services to those whose information was exposed.

The breach comes amid a rising trend of cyberattacks targeting the travel and hospitality sectors. Industry analysts have noted that cruise lines are particularly vulnerable due to the vast amount of personal data they collect and the complex IT infrastructure required to manage global operations.

Carnival’s stock price remained stable following the announcement, though investors are closely monitoring the situation for potential financial and reputational impacts. The company has not yet provided a timeline for completing its investigation or for fully remedying the security vulnerabilities that allowed the breach to occur.

Federal authorities have not yet commented on the incident, but the FBI’s Cyber Division typically investigates significant data breaches involving U.S. companies. Carnival has stated that it is cooperating fully with all relevant authorities.

As the investigation continues, questions remain about the full extent of the data compromised and whether any financial information was accessed. Carnival has urged affected customers to remain vigilant for signs of identity theft and to report any suspicious activity immediately.