On April 10, 2026, threat actors used social engineering to deceive a Carnival employee and gain access to a limited portion of the company's IT system. The attack was identified on April 14, 2026, by Carnival's IT security team who detected unauthorized activity involving an employee's account. On April 22, 2026, the company determined that the threat actor had illegally copied personal information. The breach affected 5,995,277 customers and exposed names, dates of birth, email addresses, genders, geographic locations, and loyalty program details. The data contained fields related to the Mariner Society loyalty program run by Holland America. ShinyHunters claimed to have stolen documents containing over 8.7 million records with personally identifiable information and terabytes of internal corporate data.