2026 Carnival Corporation — confirmed breach; 5,995,277 individuals (social engineering; Apr)

Carnival Corporation & plc—parent of Carnival Cruise Line, Holland America Line, Princess Cruises, and other brands—confirmed a 2026 data breach after ShinyHunters extortion activity. Maine regulatory filings cited 5,995,277 affected individuals with notification letters dated May 27, 2026. Carnival said an attacker used social engineering against an employee, gained access April 14, 2026, and copied personal data via a compromised account by April 22 before being blocked. Texas Attorney General Ken Paxton announced an ongoing investigation June 22, 2026, citing an estimated six million people affected globally including 800,060 Texas consumers per Carnival's breach notification to the Texas OAG (submitted 44 days after discovery). Trade press including Houston Chronicle and Malwarebytes reported stolen categories can include names, emails, dates of birth, genders, Mariner Society loyalty tiers, addresses, phones, government IDs (passports/driver's licenses), health information, and booking data varying by guest. ShinyHunters claimed the incident; Carnival offered 24-month TransUnion credit monitoring via MyTrueIdentity/Cyberscout.