Carnival confirms ShinyHunters cruised off with 6M customer records after April breach

Carnival Corporation confirmed a digital breach tied to an April 14 social engineering attack targeting an employee. The company did not name the alleged hackers or disclose the full scope publicly, but a filing with the Maine attorney general listed just under six million affected individuals. Earlier estimates had been higher, and the company had previously acknowledged a phishing attack without stating whether data was accessed or stolen. After ShinyHunters claimed to have taken terabytes of records, Carnival reported that the impacted data included names, addresses, email addresses, phone numbers, dates of birth, and state identification numbers. Notifications began, offering two years of free credit monitoring through TransUnion, and Carnival stated it would take additional steps to safeguard information.

"Carnival Corporation - the world's largest cruise operator - has confirmed a digital heist, a month after hacking crew ShinyHunters claimed to have stolen millions of customers' records. The breach, Carnival confirmed, stemmed from an April 14 social engineering attack on an employee, though the company declined to comment on the scale or name ShinyHunters. However, a company filing with the Maine attorney general's office puts the number of affected individuals at just under six million, down from the 8.7 million records previously listed by Have I Been Pwned."

"Carnival previously acknowledged the phishing attack at the time, but it did not say whether any data had been accessed or stolen. Following a "thorough and time-consuming analysis of the impacted data," Carnival confirmed that names, addresses, email addresses, phone numbers, dates of birth, and state identification numbers were all included in the breach. As is often the case in data theft incidents, individuals will be affected to different degrees, depending on what information they shared with the company."

""The company failed to reach an agreement with us despite our incredible patience," ShinyHunters wrote on its data leak site, adding: "They don't care." Carnival began sending notifications directly to affected individuals on Wednesday. Those communications include details about how recipients can redeem two years of free credit monitoring services, as is common in US breach notifications, via TransUnion."

"It closed its message with a promise to improve: "In addition to the comprehensive security measures the company had in place prior to the incident, it has taken steps to further safegua"

Read at theregister