A data breach at Carnival Corporation has exposed the personal information of nearly 6 million customers, after hackers utilized social engineering tactics to gain access to an employee's account on April 14. The attackers then leveraged this initial compromise to access internal systems and steal sensitive files containing customer data, affecting a total of 5,995,277 individuals. The breach has significant implications for the security of customer information, highlighting the ongoing threat posed by social engineering attacks1. Carnival Corporation has begun notifying affected individuals, as required by law, and is likely to face scrutiny over the effectiveness of its security controls. The incident serves as a reminder of the importance of robust employee training and account security measures to prevent such breaches. This matters to practitioners as it underscores the need for proactive defenses against social engineering attacks to protect sensitive customer data.