- BIST10011,722-2.89%
- USD49.45+0.05%
- EUR55.62+0.37%
- GOLD4,181.10+0.26%
- INTEREST37.00%-1.00
- BITCOIN81,366-0.17%
- October 17, 202610°
- BIST10011,722-2.89%
- USD49.45+0.05%
- EUR55.62+0.37%
- GOLD4,181.10+0.26%
- INTEREST37.00%-1.00
- BITCOIN81,366-0.17%
- October 17, 202610°
Stolen Carnival data used in fake ShinyHunters extortion email
Personal information leaked from a Carnival data breach in the US has been used in a fake cyber blackmail campaign. An email sent to a Louisiana resident demanded a $2,000 cryptocurrency ransom in the name of the ShinyHunters hacker group.
Information stolen from a data breach at Carnival Corporation in the US has become a new weapon for scammers. Wayne P., a resident of Evangeline Parish in Louisiana, received an email claiming to be from the ShinyHunters hacker group. The message threatened to send private videos, allegedly recorded through his computer camera, to his contact list unless a $2,000 payment in Litecoin was made within 48 hours.
Instead of panicking, Wayne acted immediately and ran a thorough security scan on his phone and computer. The investigation revealed that the email was part of a widespread extortion campaign, using information from a real data breach to fabricate a scenario of device compromise.
Information from the breach lent credibility to the scam
The only accurate and concrete detail in the email was the data breach that Carnival Corporation experienced in April 2026. On April 14, the company detected unauthorized access to an employee account following a social engineering attack, and on April 22, it disclosed that the attacker had copied personal information. The exposed data included names, addresses, emails, phone numbers, dates of birth, and government ID numbers. Carnival began notifying affected individuals on May 27 and offered two years of free credit monitoring to eligible US persons.
Experts stress that while the scammer knows from the breach that you use brands like Carnival or Holland America, just having your email address does not grant access to your phone, camera, or microphone. They note that this specific detail from the breach added credibility to the email, but everything else is entirely fabricated.
Signs that gave away the fake email
The message Wayne received was filled with typical extortion tactics. The email came from an unrelated address and offered no screenshots, stolen files, or recording evidence. The cryptocurrency demand, 48-hour deadline, and warning not to contact the police were classic methods to create panic. The promise that the information would be removed from the dark web after payment was also unrealistic.
The FBI previously warned that emails sent in the name of ShinyHunters may claim to have embarrassing photos or videos, and in most cases, the mentioned material does not exist at all. The Federal Trade Commission (FTC) also advises never to pay such extortion emails.
What to do if you face a similar threat
Cybersecurity experts recommend that anyone who receives a similar threatening email stay calm and follow these steps:
- Do not send cryptocurrency and do not reply to the email.
- Report the message to reportphishing@apwg. Org and to the FTC's ReportFraud website, then delete it.
- Change your Carnival or Holland America account password, especially if you used the same password elsewhere.
- Check your email account's security settings, review recent logins, and enable two-factor authentication.
- Monitor your credit reports and bank account activity; if you suspect identity theft, request a credit freeze.
- Consider using a data removal service to erase your personal information from data brokers.
Because Wayne did not click any links or download attachments, no issues were found on his devices. However, experts stress that if a suspicious link is clicked or software is installed, a deep security scan should be performed and passwords of affected accounts should be changed.
Stay Updated with Ally Daily
Subscribe to be informed about special news, developments and announcements. We will keep you informed.
By signing up, you agree to our Privacy Policy
