Carnival data breach: 7.5M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-04-24
In April 2026, the notorious hacking collective ShinyHunters claimed they had obtained a substantial volume of data belonging to the Carnival cruise operator and attempted to extort the organisation to prevent the data from being leaked. The following week, the group published the data publicly, which contained 8.7M records with 7.5M unique email addresses. The data contained fields indicating it related to the Mariner Society loyalty program run by Holland America, a cruise line brand under Carnival, and included names, dates of birth, genders and data relating to status within the loyalty program. Carnival acknowledged a phishing incident involving a single user account and advised they were working to better understand the scope of the unauthorised activity. Exposed data: dates of birth, email addresses, genders, geographic locations, loyalty program details, names, salutations. The breach dates from Apr 18, 2026; Have I Been Pwned loaded it on Apr 24, 2026.
What to do
- If you had a Carnival account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch
