Carnival Corporation & plc (carnivalcorp.com) Listed by shinyhunters Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Carnival Corporation & plc has been listed on a site associated with the shinyhunters ransomware group. The listing, reported on 19 April 2026, states that internal files were exfiltrated during a ransomware attack and claims the compromise includes over 8.7 million records containing personally identifiable information plus additional terabytes of corporate data.

The number of people affected is not known. No independent confirmation of the claimed data volume or the circumstances of the intrusion has been made public.

What happened

The available information consists of a listing placed by shinyhunters. The group describes the event as a ransomware operation in which internal files were taken and issues a final warning with a contact deadline of 21 April 2026. Details on when the intrusion occurred, how access was obtained, or the exact files involved remain undisclosed.

Inside shinyhunters

Shinyhunters is a ransomware operator that targets large organisations and maintains a public leak site where it posts data it claims to have stolen. The group typically exfiltrates material during intrusions and threatens publication if payment demands are not met. It has been linked to multiple prior incidents involving corporate networks, though each listing represents an unverified claim by the actor until independently confirmed.

About Carnival Corporation & plc

Carnival Corporation & plc operates multiple cruise lines and processes large volumes of passenger, booking, and employee information across its brands. Companies in this sector routinely collect names, contact details, payment information, travel itineraries, and identification documents. A claimed incident at this scale would therefore involve data that is both commercially sensitive and subject to privacy regulations in multiple jurisdictions.

The information in question

The listing refers to internal files exfiltrated in a ransomware attack. The group claims these files contain 8.7 million records with personally identifiable information and additional corporate data. The precise categories of information and whether the claimed volume is accurate have not been confirmed by the company or by independent investigators.

What's at stake

Individuals whose information appears in the claimed data set face the possibility of targeted phishing, account takeover attempts, or identity fraud. The organisation may encounter regulatory inquiries, costs associated with incident response, and reputational effects. Because the exact scope remains unconfirmed, the full extent of these consequences cannot yet be assessed.

What to do if you're exposed

Monitor bank and credit accounts for unusual activity and place fraud alerts with major credit bureaus if personal details appear to have been involved. Use unique passwords and enable multi-factor authentication on important accounts. Readers can run a free exposure scan of their email address against known breach data to determine whether their information has appeared in previously published data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.