Aussies amongst millions affected in Carnival Cruise Line data breach by cyber criminals

• Australians are amongst the around six million cruisers who were told by Carnival that their data was potentially stolen.
• This happened after a notorious cybercrime group temporarily accessed Carnival’s internal data.
• The Australian government has guidelines on what to do if you’re the victim of a data breach.

More than six million customers of Carnival Cruise Line have been alerted that their data could have been exposed after the company identified a cybersecurity breach on April 14.

It’s believed that a cybercrime group had access to people’s names, emails, phone numbers, and their official identification, such as passports and driver’s licenses. 

Carnival hasn’t released an estimate of how many people were affected, but a document from the attorney general’s office in America puts the number at around six million. 

A well-known cybercrime group, ShinyHunters, claimed responsibility for the hack. 

Carnival said in a statement: “”In April, we identified unauthorized access to a limited part of our IT system caused by a social engineering attack on a single user account. We immediately blocked the activity, engaged third-party security experts and alerted law enforcement. Our investigation found certain personal information was illegally accessed.

“We’re notifying affected individuals and deeply regret any concern this causes. Protecting the privacy and security of personal data is a priority for us and we’ve added new layers of security and monitoring on top of the comprehensive protections already in place. We’ll also continue advancing our defenses against evolving threats.”
Many Australians reported being amongst those who received the notice. However, while American cruisers were offered two years of free credit protection, Australian cruisers were not. 

Carnival has urged customers to stay vigilant against “threats of identity theft or fraud” and to contact police if they believe their data is being used.  

What to do if you’re affected?

The Australian government’s Office of the Australian Information Commissioner has several guidelines for those who are affected by data breaches.

• Change your passwords to important accounts, like email and online banking and enable multi-factor authentication where possible.
• Take care on phone calls. If someone calls you and claims to be from an organisation or agency, you can hang up and then call them back using their publicly available contact details.
• Check account statements and your credit report to make sure no one is attempting to access your finances. 

Ismael Valenzuela, vice president of threat intelligence research at Arctic Wolf told Cyber Daily Au: “Anyone potentially impacted should assume elevated exposure, reset passwords, tokens, and API keys that could have been exposed, enable phishing‑resistant multifactor authentication, and closely monitor for suspicious or unauthorised account activity. Data like this is often reused over time in targeted phishing, identity fraud, and broader social engineering campaigns.”