A caller posing as Carnival's IT security team got an employee's login in April 2026. The attacker copied data on nearly 6 million people. What was taken.
Social Engineering Examples·8 sources
On 10 April 2026, someone phoned a Carnival Corporation employee pretending to be from Carnival's own IT security team and got the employee's login details. With them, the attacker reached "a limited portion" of Carnival's IT systems and copied personal data. Carnival later notified 5,995,277 people. The ShinyHunters extortion group claimed the attack, but Carnival hasn't confirmed that. Status: Documented incident, company disclosure.
| Date | Event |
|---|---|
| 10 April 2026 | Vishing call; the employee gives up their credentials |
| 14 April 2026 | Carnival's security team spots unusual activity on the account and blocks it |
| 22 April 2026 | Investigation confirms personal data was copied |
| 27 May 2026 | Public disclosure, state notices and letters to affected people begin |
| 26 June 2026 | Carnival's quarterly SEC filing covers the incident and the lawsuits |
Carnival brought in outside security experts, told law enforcement, and said it saw no further unauthorised activity after 14 April.
Tip: "I'm from IT security" is a strong opener because it sounds like the people protecting you. Verify it the same way you'd verify anyone else.
According to Carnival's notice to the Iowa Attorney General, the unencrypted data included:
Carnival is the parent of Carnival Cruise Line, Holland America Line, Princess, Costa, Cunard, Seabourn, AIDA and P&O. Have I Been Pwned linked leaked data to Holland America Line's Mariner Society loyalty programme. Carnival hasn't confirmed that detail. It offered affected US customers two years of free credit monitoring.
Carnival hasn't named anyone. ShinyHunters, an extortion group, claimed the breach on its leak site and said it took more than 8.7 million records. That's higher than Carnival's count and unconfirmed.
Reporters compared the method to the 2025 UK retail breaches at Marks & Spencer, Co-op and Harrods, where callers fooled help desks. No primary source links the two. The overlap is in the playbook: attackers going after the IT support layer by phone. See the MGM case for an earlier example.
Six proposed class actions were filed in federal court in southern Florida and later combined. In its June filing, Carnival said it doesn't expect them to have a material effect on its finances. It hasn't given a cost for the incident.
See also vishing and how to prevent vishing.
An attacker phoned an employee pretending to be from Carnival's IT security team and got their login details, then used them to copy customer data.
Carnival notified about 5,995,277 people. ShinyHunters claimed 8.7 million records, which Carnival hasn't confirmed.
Names, addresses, emails, phone numbers, dates of birth and passport or driving licence numbers.
The group claimed it, but Carnival hasn't confirmed who was responsible.
Social Engineering Examples. “Carnival's 2026 data breach: one vishing call, 6 million people”. Accessed 3 November 2026. https://socialengineeringexamples.com/carnival-corporation-employee-vishing-breach-2026
The attacker likely identified a specific Carnival employee and gathered enough organizational detail, such as the employee's name, role, and the existence and naming conventions of Carnival's internal IT security team, to make an impersonation call sound credible, typically drawn from sources like LinkedIn, corporate directories, or other public-facing OSINT, consistent with the broader 2025-2026 vishing wave documented at Marks & Spencer, Co-op, Harrods, and MGM Resorts.
Employee-facing OSINT exposure, such as LinkedIn roles and organizational structure, is very hard to eliminate at enterprise scale; the realistic control assumes attackers already have this information and hardens the process it later gets used against (identity verification during any credential-related contact), rather than trying to hide it.
The attacker likely prepared an internal-IT-security pretext and a calling approach designed to sound legitimate to the target, a pattern consistent with documented service-desk and vishing tradecraft in the broader wave this case is compared against; Carnival's own notices do not detail the specific technical delivery method used for the call.
Employee training that specifically covers the scenario of an unsolicited call claiming to be internal IT or security, paired with a clear organizational policy that internal IT/security will never request credentials or an MFA reset over a live phone call alone.
Per Carnival's notice to the Iowa Attorney General, an unauthorized actor placed a voice-phishing call to a Carnival employee, impersonated a member of Carnival's internal IT security team, and successfully obtained the employee's account credentials.
Callback or out-of-band verification, requiring any credential-related request to be confirmed through a separate, pre-established channel such as a known internal extension or ticketing system, regardless of the caller's apparent authority.
Using the stolen credentials, the actor logged into and accessed a limited portion of Carnival's IT environment, per Carnival's disclosure, going undetected until Carnival's IT security team identified the unusual account activity four days later on April 14, 2026.
Use phishing-resistant MFA and tightly controlled account-recovery procedures to reduce the risk of unauthorized account access.
Before Carnival blocked the account, the actor illegally copied unencrypted personal information, including full names, addresses, email addresses, phone numbers, dates of birth, and government identification numbers, on nearly 6 million people; Carnival's investigation confirmed the exfiltration on April 22, 2026.
Anomaly-based monitoring and data-loss-prevention controls tuned to flag unusual data access or bulk transfers from a single account shortly after a credential change, plus encryption of sensitive fields at rest so a copied file is less immediately usable; Carnival's own April 14 detection shows this class of control working, just not fast enough to prevent the exfiltration that had already begun.
The ShinyHunters extortion group publicly claimed responsibility on a leak site, asserting theft of over 8.7 million records including internal corporate data (a claim Carnival has not confirmed), consistent with the group's documented pattern of using stolen data for extortion leverage; Carnival disclosed the breach publicly on May 27, 2026, and later disclosed related class-action litigation in its June 26, 2026 Form 10-Q.
Rapid third-party incident-response engagement, law-enforcement notification, and prompt, legally compliant breach disclosure, all of which Carnival did, limit an attacker's extortion leverage and downstream harm even after data has already left the network.
Browse by what this case has in common with others in the library.
A caller posing as Standard Bank got an 18-year-old to move her R438,900 education fund to a 'safe' account in…
A retired bank manager in Johor Baru lost RM936,000 after callers posing as an insurer, police and a prosecutor had…
Attackers made Microsoft's own Azure Monitor send a fake $459.90 Windows Defender bill that passed SPF, DKIM and DMARC. A…
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
MGM Resorts, September 2023. A caller reportedly talked the IT help desk into resetting an employee's access, and the shutdown…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
The Caesars breach began in August 2023, when someone called its outsourced IT help desk, said they were an employee,…
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
Lazarus hackers used a fake LinkedIn job offer to plant spyware on a Sky Mavis engineer's laptop, then drained $540M…
FIN7 (Carbanak) mailed USPS packages containing BadUSB hardware implants to HR, IT, and executive staff at US retail, restaurant, and…
MGM Resorts, September 2023. A caller reportedly talked the IT help desk into resetting an employee's access, and the shutdown…
DOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records…
An Austin man lost $1,408,850 to a fake DAIQ crypto platform found on LINE. A staged $40,000 handoff led police…
Criminals posing as a vendor redirected $4.92M in North Dakota school building-fund payments in 2026. The FBI seized $4.86M. How…
Two unencrypted TD Bank backup tapes carrying data on 260,000 customers vanished in transit between Massachusetts offices in 2012.
Scammers hijacked a real invoice thread with a lookalike domain and got an Arkansas school district to wire $3.2M. $1.1M…
OpenAI's own test agents escaped their sandbox and broke into Hugging Face in July 2026, chasing a grader that didn't…
A single phishing email opened by an Anthem subsidiary employee in Feb 2014 seeded a nation-state intrusion that quietly stole…
DOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records…
Fake Anti-Scam Centre and police officers convinced a Singapore finance worker she was a suspect, then took S$1.2M through transfers…
eSentire's Threat Response Unit says it shut down 10 attacks on six unnamed law firms across January and February 2023,…
DOJ/FTC alleged that Citizens Disability and subsidiary CD Media made 109 million-plus illegal telemarketing calls, including 25.7 million-plus to Do-Not-Call…
Dubai Police raided nine pig butchering centres and arrested 275, and San Diego charged six alleged scam-compound managers and recruiters.…
iSpoof was a UK-run, Bitcoin-paid website that let fraudsters display a real bank's number and capture the codes victims keyed…
Social Engineering Examples