Loading story…
ShinyHunters claimed responsibility for a major breach affecting Carnival Corporation, with data tied to Holland America Line’s Mariner Society loyalty program appearing online after an alleged extortion attempt failed. According to Have I Been Pwned, the leaked dataset contained 8.7 million records and 7.5 million unique email addresses, including names, dates of birth, genders, and loyalty program status details. Carnival acknowledged a security incident and said it had identified a phishing attack involving a single user account, while continuing to assess the scope of unauthorized access; the gang separately alleged it also stole terabytes of internal corporate data, a claim that had not been independently verified.
The same group also posted a "Pay or Leak" notice claiming it had compromised Udemy and stolen more than 1.4 million user records along with internal corporate data, giving the company a deadline before any public release. Udemy had not confirmed the incident at the time of reporting, leaving the claim unverified, but the allegation fits a broader ShinyHunters campaign targeting SaaS and education organizations through social engineering, credential theft, MFA bypass, and abuse of third-party access. The incidents underscore the group’s continued use of extortion-backed data theft to pressure victims and expose customer information.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In April 2026, data allegedly stolen from Udemy was publicly leaked following a ShinyHunters 'pay or leak' extortion attempt. The exposed dataset reportedly contained 1.4 million unique email addresses along with names, addresses, phone numbers, employer details, and instructor payout method information.
On its leak site, ShinyHunters claimed it had compromised Udemy and stolen more than 1.4 million records containing personal and internal corporate data. The post gave Udemy until 2026-04-27 to respond before the data would allegedly be leaked publicly, and the claim was unverified at publication.
About one week after its extortion attempt, ShinyHunters publicly released a dataset allegedly tied to Carnival's Holland America Line Mariner Society program. The leak reportedly contained 8.7 million records and 7.5 million unique email addresses, including names, dates of birth, genders, and loyalty status information.
In April 2026, ShinyHunters claimed it had stolen Carnival-related data and tried to extort the company to prevent publication. The group also alleged it had obtained customer data and terabytes of internal corporate data, though the full scope was not independently confirmed.
Carnival said it identified a phishing incident affecting a single user account and began assessing the scope of any unauthorized activity tied to Holland America Line's Mariner Society loyalty program.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcehaveibeenpwned.com
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourcego.theregister.com
Open sourcethecyberthrone.in
Open sourcehaveibeenpwned.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **ShinyHunters** extortion group claimed it breached online learning platform **Udemy** and stole more than **1.4 million user records**, according to multiple reports. The attackers allegedly said the haul includes personally identifiable information and internal corporate files, raising concerns that affected users could face phishing, identity fraud, and other follow-on abuse if the data is authentic. The group reportedly threatened to publish the stolen information unless Udemy entered negotiations, with reporting indicating a leak deadline of **April 27**. Researchers and media outlets noted that the exact contents of the dataset had not been independently verified because no sample had been publicly released at the time, but the claim placed Udemy among a growing list of organizations publicly named by ShinyHunters in recent extortion activity.
Jun 29, 2026
Car-shopping platform **CarGurus** disclosed a data breach affecting **12.4 million accounts**, after the **ShinyHunters** extortion group claimed it had stolen customer records and offered a dataset for sale. Reporting indicated the exposed information included account and profile data tied to millions of users, while earlier claims from the group had put the haul at roughly **1.7 million records**, highlighting uncertainty around the exact scope as public reporting evolved. A separate incident hit **Carnival Corporation**, where a dataset flagged by **Have I Been Pwned** contained **8.7 million records** and **7.5 million unique email addresses** allegedly linked to **Holland America Line’s Mariner Society** loyalty program. The data reportedly included names, dates of birth, gender, and membership-status details, raising fraud and phishing concerns. Carnival said it was investigating what it described as a phishing attack involving a single user account, but ShinyHunters claimed responsibility and alleged it also stole terabytes of internal corporate data, suggesting the compromise may extend beyond a limited account breach.
Jun 29, 2026
Instructure disclosed a major breach of its **Canvas** learning management system after the **ShinyHunters** group allegedly exploited a vulnerability in the platform’s **Free-For-Teacher** account program on April 30, 2026. The attackers claimed to have stolen data on **275 million individuals**, including student, faculty, and staff information and private messages between students and teachers, with reports estimating about **3.65 TB** of exfiltrated data. The incident was reported to affect thousands of institutions worldwide, with cited impact ranging from **8,809** to roughly **15,000** schools and organizations across the U.S., Europe, and the U.K. After Instructure initially chose to patch systems rather than negotiate, ShinyHunters escalated the campaign by **defacing Canvas login portals** and disrupting final examinations at multiple universities when a ransom deadline approached. Instructure later suspended the Canvas portal during the fallout, and subsequent reporting said the company paid a ransom after receiving digital confirmation that the stolen data had been destroyed and that customers would not face further extortion. The operation was characterized as a **pay-or-leak extortion campaign** that abused account access, application-layer weaknesses, and platform or API functionality rather than deploying malware or encrypting systems.
Jul 7, 2026