Loading story…
Carnival Corporation disclosed a data breach after a threat actor used social engineering to compromise an employee account and gain unauthorized access to a limited portion of the company’s internal IT systems. The company said it detected suspicious activity on April 14, contained the intrusion with help from third-party cybersecurity specialists, and confirmed by April 22 that customer personal information had been copied from affected systems.
The exposed data included names, addresses and other contact details, dates of birth, government-issued identification numbers linked to passports and driver’s licenses, and in some cases Social Security numbers. Reports said about 6 million people in the United States may be affected. Carnival began notifying impacted individuals on May 27, issued a public notice for people it could not contact directly, and is offering 24 months of complimentary credit monitoring through TransUnion MyTrueIdentity. The company has not identified the threat actor or said whether ransomware or extortion was involved.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The ShinyHunters hacking group claimed it had stolen millions of Carnival customer records and posted the company on its pay-or-leak site. Reporting said the leaked data was tied to Holland America Line’s Mariner Society loyalty program and included personal and loyalty-related information.
A Maine breach notice cited in reporting stated that Carnival's April 2026 incident affected 5,995,277 people. The disclosure materially expanded the known scope of the breach beyond earlier notices that only described the categories of personal information copied.
Carnival began sending notification emails to affected individuals on May 27, 2026, and also issued a public notice for people it could not directly contact. The company offered 24 months of complimentary TransUnion credit monitoring to affected U.S. customers.
By April 22, 2026, Carnival had confirmed that customer personal information had been copied in the incident. Reported exposed data included names, dates of birth, contact details, and government-issued identification information, with one report also stating Social Security numbers may have been affected.
Carnival said it detected unauthorized activity on April 14, 2026, after a threat actor used social engineering to compromise an employee account and access a limited portion of its internal IT systems. The company contained the intrusion and engaged third-party cybersecurity specialists.
Carnival said threat actors gained access to its environment on April 10, 2026, after socially engineering an employee account. The access preceded the company's detection of unauthorized activity on April 14.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcexakep.ru
Open sourcetechrepublic.com
Open sourcesecurityaffairs.com
Open sourcehelpnetsecurity.com
Open sourcetheregister.com
Open sourceteiss.co.uk
Open sourcecyber.nj.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Car-shopping platform **CarGurus** disclosed a data breach affecting **12.4 million accounts**, after the **ShinyHunters** extortion group claimed it had stolen customer records and offered a dataset for sale. Reporting indicated the exposed information included account and profile data tied to millions of users, while earlier claims from the group had put the haul at roughly **1.7 million records**, highlighting uncertainty around the exact scope as public reporting evolved. A separate incident hit **Carnival Corporation**, where a dataset flagged by **Have I Been Pwned** contained **8.7 million records** and **7.5 million unique email addresses** allegedly linked to **Holland America Line’s Mariner Society** loyalty program. The data reportedly included names, dates of birth, gender, and membership-status details, raising fraud and phishing concerns. Carnival said it was investigating what it described as a phishing attack involving a single user account, but ShinyHunters claimed responsibility and alleged it also stole terabytes of internal corporate data, suggesting the compromise may extend beyond a limited account breach.
Jun 29, 2026
CareCloud disclosed that hackers breached an AWS environment tied to its CareCloud Health electronic health record platform and accessed a data store between March 10 and March 16, disrupting the environment before the company secured it. Breach notices filed with state attorneys general and subsequent reporting indicate the attackers claimed to have exfiltrated database data, with the incident affecting roughly **345,000 to 350,000** people in the United States. The compromised information included names, addresses, dates of birth, Social Security numbers, driver’s license and other government ID numbers, bank account and payment card details, and medical and health insurance records. CareCloud said it engaged external cybersecurity experts, removed the threat, found no evidence of persistent unauthorized access, and is offering up to **24 months** of identity theft protection and credit monitoring, while no ransomware or extortion group had publicly claimed responsibility at the time of reporting.
Aug 2, 2026
AssuranceAmerica Managing General Agency disclosed a cyber intrusion that exposed the personal and insurance-related data of up to **6,998,886 individuals** after an unauthorized third party compromised an employee account and accessed parts of the company’s internal network. The company said the malicious activity occurred on March 16, 2026, was detected on March 17, and resulted in copied data files containing names, contact details, automobile insurance policy and account information, driver and vehicle information, and claims records. For some affected people, the exposed data may also include **driver’s license numbers**, **Social Security numbers**, and **Tax ID numbers**. AssuranceAmerica said it completed its forensic review on June 15 and began notifying affected individuals in July, after initially reporting a smaller impact before later filings raised the total to nearly 7 million. In response, the insurer took affected servers offline, isolated impacted systems, disabled compromised credentials, reset passwords, expanded monitoring and threat detection, increased employee cybersecurity training, notified law enforcement, and offered two years of identity protection and credit monitoring through IDX. The company also warned customers to watch for phishing attempts and identity-related fraud.
Jul 14, 2026