🤚 The Open-Palm Damage Report

In what is becoming a disturbingly reliable annual tradition, Carnival Corporation — operator of the world’s largest cruise fleet — has confirmed a data breach affecting 5,995,277 customers. The exposed data includes names, dates of birth, email addresses, genders, geographic locations, and loyalty program details, primarily from Holland America’s Mariner Society program.

The timeline, as is customary, reads like a procedural drama where nobody watches the security cameras:

• April 10, 2026: The breach occurred
• April 14, 2026: Carnival’s IT security team noticed unauthorized activity — four days later, which in breach terms is considered practically clairvoyant
• April 22, 2026: The company determined attackers had copied personal information
• May 28, 2026: Carnival began notifying affected customers — 48 days after the breach, because nothing says “we value your privacy” like a month and a half of silence

The ShinyHunters cybercrime group has claimed responsibility, alleging they stole over 8.7 million records and terabytes of corporate data. Carnival has not officially attributed the attack, presumably because acknowledging your attacker by name makes the investor call even more uncomfortable.

👐 The Two-Handed Repeat Offender

Here is the part where we are contractually obligated to mention that this is Carnival’s fourth major data breach since 2020. Four. In six years. The loyalty program members are, one might argue, not the only ones demonstrating a pattern of repeat engagement.

The attack vector? Social engineering. According to Carnival’s own disclosure, “an unauthorized actor used social engineering to deceive an employee to gain access to a limited portion of the Company’s IT system.” In plainer terms: someone called an employee and asked nicely. The employee obliged. The “limited portion” of the IT system turned out to contain six million people’s personal details, which suggests the company’s definition of “limited” is as flexible as its definition of “security.”

If this sounds familiar, it should. Just last week, we covered Charter Communications confirming a 40 million record breach after ShinyHunters called an employee on April Fools’ Day. The methodology is identical: no zero-days, no sophisticated exploit chains, no quantum cryptanalysis. Just a phone call. The entire multibillion-dollar cybersecurity industry — the firewalls, the endpoint detection, the threat intelligence feeds, the SOC teams drinking cold coffee at 3 a.m. — defeated by a human being who answered a question they shouldn’t have.

The FBI has helpfully advised victims not to pay ransom demands, noting that “payment does not guarantee non-reoffense.” This is the law enforcement equivalent of telling someone who has been pickpocketed four times that maybe they should stop carrying their wallet in their back pocket.

🌿 The Gentle Awakening

There is something almost philosophical about a cruise company being breached this way. Cruises are, by design, floating environments where you surrender control to a large organization in exchange for a pleasant experience. You hand over your passport, your credit card, your dietary preferences, and your GPS coordinates. The entire business model is built on trust that the operator will keep your information safe while you eat unlimited shrimp and attend a magic show.

What Carnival’s fourth breach reveals is not a technology failure but a cultural one. You can deploy every security tool on the market, but if one employee can be convinced to hand over access with a convincing phone call, the technology is decorative. It’s a lock on a door that someone holds open.

ShinyHunters, for their part, are having a remarkable 2026. Charter, Canvas LMS, and now Carnival — that’s over 320 million records across three major breaches in a single quarter, all accomplished through the sophisticated technique of talking to people.

👑 The Gold-Leaf Reckoning

Carnival’s stock barely flinched on the news, which tells you everything about the current state of breach accountability. Six million records? Priced in. Fourth breach in six years? Tradition. The market has collectively decided that data breaches are not crises but weather events — unpleasant, recurring, and ultimately not worth canceling the earnings call over.

For the six million affected customers, the experience is grimly predictable: a notification letter in the mail, a year of complimentary credit monitoring that expires before most identity theft actually occurs, and the lingering knowledge that their loyalty points were not the only thing being collected.

Meanwhile, somewhere in a Discord channel, ShinyHunters is already planning the next phone call. The target doesn’t know it yet, but statistically speaking, their employee training program probably includes a ten-minute video about phishing that everyone clicks through without watching.

The buffet is open. The data is flowing. And the boarding pass now comes with a complimentary identity exposure.

“The employee answered the phone, the hacker asked a question, and six million records walked off the ship without a boarding pass. We have reached the point where ‘Can I speak to someone in IT?’ is a zero-day exploit.” — The Slap of Wisdom Incident Response Desk, currently on a cruise that it booked under a fake name