// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE BRC-newsDTG 0600Z
ColdRecon / Breach Radar / Carnival
Breach Record

Carnival

DISCLOSED 2026-05-28 · PHISHING · 6,000,000 RECORDS EXPOSED

Carnival disclosed a data breach affecting nearly 6 million people. Hackers used social engineering to gain access. The exposed data includes personal information.

The record

What we know

Disclosed
2026-05-28
Attack vector
Phishing
Sector
travel
Records exposed
6,000,000
Data classes exposed
personal data
ColdRecon assessment

Could a positive-security control have prevented this?

Verdict · unclear · opinion

The text only mentions social engineering without details on endpoint compromise, so it is unclear if a positive-security model would have prevented the breach.

Our assessments are opinion, grounded in the cited public facts. Read them critically.

Sources

Cited reporting

Similar vector · recent

Other phishing breaches on file

This page is the permanent ColdRecon entry for the Carnival disclosure. It updates if new public reporting emerges. All tracked breaches →

Carnival just lived through this. Your next prospect doesn't have to.

ColdRecon turns every disclosed breach into a daily intelligence brief from the seller's seat — normalized to the factors that move a deal, written in the Handler's voice. Request clearance and the first lands tomorrow at 0600.

Request Clearance →