Carnival Corp alerts 5,995,277 people of data breach

Carnival Corporation, the world's largest cruise operator, has notified nearly six million individuals that their personal information was stolen in a data breach last month. The company confirmed the incident this week after a thorough investigation.

The breach occurred after an unauthorized actor used social engineering to deceive an employee and gain access to a limited portion of the company's IT systems on April 14. By April 22, investigators determined the attacker had illegally copied files containing personal data. According to a filing with the Maine Attorney General's Office, 5,995,277 people were affected.

The stolen information varies by individual but generally includes names, addresses, dates of birth, email addresses, phone numbers, and government-issued identification numbers such as passport and driver's license details. The company stated it acted swiftly to block the unauthorized activity and immediately engaged third-party security experts to investigate and strengthen its systems.

The extortion group ShinyHunters claimed responsibility for the attack in April, alleging it stole over 8.7 million records. An analysis of data leaked by the group suggests the...