ShinyHunters Claims CarGurus and Carnival Customer Data Breaches

Car-shopping platform CarGurus disclosed a data breach affecting 12.4 million accounts, after the ShinyHunters extortion group claimed it had stolen customer records and offered a dataset for sale. Reporting indicated the exposed information included account and profile data tied to millions of users, while earlier claims from the group had put the haul at roughly 1.7 million records, highlighting uncertainty around the exact scope as public reporting evolved.

A separate incident hit Carnival Corporation, where a dataset flagged by Have I Been Pwned contained 8.7 million records and 7.5 million unique email addresses allegedly linked to Holland America Line’s Mariner Society loyalty program. The data reportedly included names, dates of birth, gender, and membership-status details, raising fraud and phishing concerns. Carnival said it was investigating what it described as a phishing attack involving a single user account, but ShinyHunters claimed responsibility and alleged it also stole terabytes of internal corporate data, suggesting the compromise may extend beyond a limited account breach.