Carnival Corporation, the largest cruise company globally, announced a data breach that exposed the personal information of approximately 6 million customers. The company identified unauthorized access to its IT system in April, which was attributed to a social engineering attack on a single user account. Following the breach, Carnival engaged third-party security experts and notified law enforcement.
According to a data breach notice filed with the Maine Attorney General’s office, the breach affected 5,995,277 individuals. The investigation revealed that names, email addresses, phone numbers, dates of birth, and driver’s license and passport numbers were compromised. Carnival stated that it is conducting a thorough analysis to determine the extent of the breach and has sent notification letters to those affected.
Carnival is offering U.S. customers two years of free credit monitoring through TransUnion and is advising them to monitor their accounts for any signs of fraud or identity theft. The company expressed regret for any concern caused by the incident and emphasized its commitment to enhancing security measures. The breach has prompted discussions among affected customers, with some expressing frustration on social media platforms regarding the handling of the situation. Reports have emerged claiming that the hacking group ShinyHunters may have been involved, although Carnival has not confirmed this information.