Carnival discloses social-engineering breach affecting about 6 million customers
May, 2026 (Detected April 14, disclosed May 2026)
Carnival's notice says it found unauthorized activity involving an employee account on April 14. The company said an unauthorized actor used social engineering to trick an employee into giving access to a limited part of its IT systems. An industry summary puts the number of affected customers at about 6 million. The breach was made public in May.
Why it matters
A single convincing conversation with one employee was enough. Technical controls were not the weak point.
What defenders can take from it
- Train staff, especially help desks, to verify the identity of anyone asking for access.
- Limit what a single compromised employee account can reach.