In April 2026, Carnival Corporation discovered that an attacker had talked an employee into handing over access to part of its systems. By the time notification letters went out in late May, the breach had settled into a single headline number: nearly six million customers affected. The group ShinyHunters claimed responsibility and said the real haul was closer to 8.7 million records. Carnival hasn’t confirmed that attribution, but its own disclosure is specific about the method. Someone was deceived, but nothing was exploited in the technical sense of the word.
Carnival’s own breach notice says the attacker took names, home addresses, dates of birth, phone numbers, driver’s license numbers, and passport numbers. That is bad news for six million travelers on its own. Paired with what is already public about the same people, each row becomes a targeting file.
Take the simplest data most knowledge workers have: a LinkedIn profile listing their name, their employer, and their title. Add it to the Carnival rows. Then add what any public data broker sells, relatives, prior addresses, and a current cell number, and a full targeting dossier emerges on each individual. With AI, combining these data sets and sorting six million victims by employer takes an afternoon, and the output is an attack campaign.
Attackers prioritize the people in that pile who work at a bank, a hospital, a utility company, or a defense contractor. Each of them now comes with a combined data set: a phone number that can be spoofed, and a date of birth and license number that can pass a help desk proof-of-identity check.
In another case, in 2023, Scattered Spider got into MGM Resorts and Caesars by calling IT help desks. The attackers impersonated employees, armed with details pulled from public profiles, and talked the help desk into a password reset. CrowdStrike’s 2026 Threat Hunting Report found vishing rose 134% from 2024 to 2025. It doubled again in the first half of 2026. The way in was a phone call and enough identity data to pass as the employee. No software was exploited.
In 2024, an employee at the engineering firm Arup joined a video call with people who looked and sounded like his CFO and several colleagues. Every one of them was a deepfake. The attackers had harvested voice, image, and video samples from publicly available footage to build a convincing pretext with a plausible backstory, and the scam ended with roughly $25 million siphoned out of Arup’s accounts before anyone caught it. At Carnival, MGM, Caesars, and Arup, the first door the attacker opened was a person.
Every breach like this resets the risk baseline for security organizations. The pool of exposed external identity data gets a little deeper and a little more specific, and the next pretext gets a little easier to build.
MITRE, the nonprofit behind the ATT&CK framework most security teams rely on to describe attacker behavior, covers this exact problem under technique T1589, Gather Victim Identity Information. Like the rest of the reconnaissance tactic, it has no real preventive control attached to it. MITRE’s own guidance on the technique says, in short: keep less identity data out there to gather.
VanishID was built to address this external identity exposure problem for executives and their families, privileged users, entire workforces, and customers who are also exposed to fraud and related targeting. We see the digital lives of people the same way an attacker does, and we predict who is most likely to be targeted and how.
That visibility gives traditional reactive security controls such as identity verification, KYC, IdP, EDR, and email security a predictive edge over the attacker.
How much of what it would take to impersonate your leadership, your high-access employees, or your customers is already sitting in public view, waiting for an attacker to harvest it?
Pull your help desk’s identity verification questions. For each one, check whether a stranger could answer it from LinkedIn, a data broker site, or an old conference bio in twenty minutes. If the answer is yes, it’s a script an attacker already has.
_________
Sources
Join our LinkedIn group Information Security Community!
——————————————————-
Click Here For The Original Source.
