ShinyHunters Claims Carnival and Udemy Breaches in Extortion Campaign

ShinyHunters claimed responsibility for a major breach affecting Carnival Corporation, with data tied to Holland America Line’s Mariner Society loyalty program appearing online after an alleged extortion attempt failed. According to Have I Been Pwned, the leaked dataset contained 8.7 million records and 7.5 million unique email addresses, including names, dates of birth, genders, and loyalty program status details. Carnival acknowledged a security incident and said it had identified a phishing attack involving a single user account, while continuing to assess the scope of unauthorized access; the gang separately alleged it also stole terabytes of internal corporate data, a claim that had not been independently verified.

The same group also posted a "Pay or Leak" notice claiming it had compromised Udemy and stolen more than 1.4 million user records along with internal corporate data, giving the company a deadline before any public release. Udemy had not confirmed the incident at the time of reporting, leaving the claim unverified, but the allegation fits a broader ShinyHunters campaign targeting SaaS and education organizations through social engineering, credential theft, MFA bypass, and abuse of third-party access. The incidents underscore the group’s continued use of extortion-backed data theft to pressure victims and expose customer information.