Carnival Breach: ShinyHunters Exposes 7.5M Loyalty Program Accounts
In April 2026, the ShinyHunters hacking collective claimed a significant data acquisition from Carnival, the cruise operator. The group attempted extortion, but when unsuccessful, publicly leaked 8.7 million records, containing 7.5 million unique email addresses. Have I Been Pwned confirmed the breach, indexing the affected accounts.
The compromised data, according to Have I Been Pwned, pertained to the Mariner Society loyalty program of Holland America, a Carnival brand. It included sensitive personal details such as names, dates of birth, genders, and loyalty program status information. Carnival acknowledged a phishing incident involving a single user account, stating they were investigating the scope of the unauthorized activity.
This incident highlights the pervasive risk of phishing as an initial access vector, even for sophisticated threat actors like ShinyHunters. A single compromised account can quickly escalate into a massive data exfiltration event, impacting millions of customers and exposing valuable loyalty program data.
What This Means For You
- If you are a Carnival customer, particularly a member of the Holland America Mariner Society, assume your personal data is compromised. Update passwords on all linked accounts, enable multi-factor authentication everywhere possible, and be vigilant against targeted phishing attempts leveraging this exposed information. This breach provides attackers with a rich dataset for social engineering.
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
ShinyHunters Phishing Account Compromise - Mariner Society
Written by SCW Research
Related Posts
Breeze Cache Plugin Exploit: Unauthenticated File Upload Hits WordPress
BleepingComputer reports active exploitation of a critical file upload vulnerability in the Breeze Cache WordPress plugin. This flaw allows unauthenticated attackers to upload arbitrary files...
US Sanctions Cambodian Senator for Massive Scam Compound Operations
The U.S. Treasury Department has sanctioned Cambodian Senator Kok An and 28 associates for their alleged involvement in operating fraudulent 'scam compounds.' These operations reportedly...
CISA Breach: Cisco Vulnerability Led to Persistent Backdoor
A U.S. government agency, unnamed but confirmed by CISA, was compromised via a Cisco vulnerability, according to The Record by Recorded Future. The attack deployed...