Skip to content
HACKTECH
BreachesReported Published 3 sources

Carnival says social engineering led to breach; Maine filing lists 5,995,277 people

Carnival announced on 27 May 2026 that an unauthorised actor gained access to a limited portion of its IT system after deceiving an employee in what it described as a social engineering operation. According to NBC 6 South Florida, its IT team discovered the breach on 14 April and determined on 22 April that passenger information was affected, including government-issued ID numbers such as driver's licence and passport numbers. Carnival did not give a figure, but NBC 6 and TMC Insight reported that a notice filed with the Maine attorney general's office lists 5,995,277 people affected.

  • travel
  • cruise lines
  • social engineering
  • passport data
  • personal data

What the sources report

  • NBC 6 South Florida reported that a company notice filed with the Office of the Maine Attorney General stated 5,995,277 persons were affected; TMC Insight reported the same figure from the Maine filing, as did SecurityWeek, and Carnival itself did not give a number.
  • Affected data includes names, addresses, email addresses, phone numbers, dates of birth and government-issued identification numbers such as driver's licence and passport numbers.
  • Carnival said it acted to block the unauthorised activity, hired third-party security experts, implemented enhanced security and monitoring controls and is offering two years of free credit monitoring through TransUnion; TMC Insight reported that it also notified law enforcement.
  • TMC Insight reported that Carnival, in an online FAQ, attributed the gap between the April detection and later customer notifications to the analysis needed to determine what had been accessed and who was affected.

What it means for your organisation

A single deceived employee opened access that Carnival described as limited but that reached passenger records including passport and driver's licence numbers. The size of a breach like this is set by how many guest records one staff account can read and whether ID numbers are masked in the tools that account uses.

What we check

  • Run vishing and pretexting exercises against staff and the helpdesk, including password and MFA reset procedures.
  • Map which roles and accounts can query guest records containing passport and licence numbers, and remove standing access that is not needed.
  • Check whether government ID numbers are encrypted, tokenised or masked in operational and customer-service tools.
  • Verify alerting when one account reads or exports an unusually large number of guest records.
  • Review the time from detection to notification against state and international breach-notification requirements.

Sources

Services that cover these checks

  • Social engineering assessment

    Phishing, vishing and physical pretexting run against your staff, help desk and finance team, only under written authorisation that names the targets, pretexts and limits. Results are reported by channel and pretext, never by name: how far a convincing approach got, how many people reported it and how long the first report took to reach someone who acted.

    Duration: 2 to 4 weeks including campaign preparation

  • Database security audit

    A configuration and access review of your production databases: who can connect, from where and with which privileges, whether data is encrypted at rest and in transit, what is logged, and whether backups would survive the same attacker. We read each instance's live configuration.

    Duration: 3 to 7 working days

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Red team & purple team

    Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

    Duration: 3 to 6 weeks

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow incident response works