Fake ShinyHunters sextortion email uses Carnival breach data

Wayne P. of Evangeline, Louisiana, opened an email that would marque astir anyone's tummy drop. The sender claimed to correspond the ShinyHunters hacking radical and demanded $2,000 successful Litecoin wrong 48 hours. The connection besides claimed hackers had recorded intimate videos done Wayne's camera and planned to nonstop them to his contacts.

Wayne paused alternatively of paying. He ran information scans connected his telephone and PC, past contacted CyberGuy.

"Just received the connection below. I deliberation it's phony and information scans of my telephone and PC bespeak nary issues. I besides forwarded this to 'reportphishing.' Any comments?"
Wayne P., Evangeline, Louisiana

Wayne's instincts were right. The email intimately matches a wide sextortion run that uses existent breach accusation to enactment an invented instrumentality takeover. So, what gave this scam away, and what should you bash if a menace similar this lands successful your inbox?

AMAZON RECALL TEXT SCAM COMES WITH RED FLAGS

This is the existent sextortion email sent to Wayne, utilizing Carnival breach details, a $2,000 Litecoin request and a 48-hour deadline to make panic. (Kurt "CyberGuy" Knutsson)

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our escaped CyberGuy Live class, "Sick of Spam?", has ended, but you tin inactive ticker the afloat replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you measurement by measurement done elemental ways to trim robocalls, spam texts, junk email and unwanted messages. You’ll besides larn however to curb governmental texts, cleanable up your inbox and spot messages that could enactment your idiosyncratic accusation astatine risk.

Get the free replay and checklist now astatine CyberGuyLive.com.

Fake ShinyHunters sextortion email targets Carnival customers

Wayne's email follows a acquainted sextortion script. The sender claims hackers reached his telephone and computer, past says they recorded intimate enactment done his camera. However, the connection offers nary proof. Wayne received nary screenshot, stolen record oregon illustration of the expected recording. The request for $2,000 successful Litecoin, the 48-hour deadline and the informing against contacting constabulary each constituent to an extortion scam built to make panic.

The FBI has warned that emails signed with the ShinyHunters sanction whitethorn incorporate mendacious claims astir embarrassing photos oregon videos. In galore cases, the worldly described successful the connection ne'er existed. CyberGuy has covered akin sextortion emails that usage idiosyncratic details and Google Maps images to marque a bluff consciousness disturbingly personal.

Carnival information breach gives the scam credibility

The scam contains 1 close detail. Carnival Corporation disclosed a information breach aft an April 2026 societal engineering attack. Carnival said its information squad recovered unauthorized enactment involving an worker relationship connected April 14. The institution blocked the enactment and brought successful extracurricular information experts. On April 22, investigators determined that the attacker had copied idiosyncratic information. The exposed information varied by person. Carnival listed names, location addresses, email addresses, telephone numbers, commencement dates and government-issued recognition numbers. The institution began sending notices connected May 27. It besides offered eligible radical successful the U.S. 2 years of complimentary recognition monitoring.

CyberGuy antecedently explained however the Carnival breach whitethorn enactment your question information astatine risk. Our study noted that astir 6 cardinal radical whitethorn look phishing oregon individuality theft risks aft the breach. A scammer whitethorn cognize that you utilized Carnival oregon Holland America due to the fact that your accusation appeared successful leaked data. However, an email code unsocial gives the sender nary power implicit your phone, camera, microphone oregon keyboard. The breach supplies the believable detail. The scammer invents the rest.

CyberGuy reached retired to Carnival for comment, and a Carnival Corporation spokesperson provided america with the pursuing statement:

"In April, we identified unauthorized entree to a constricted portion of our IT strategy caused by a societal engineering onslaught connected a azygous idiosyncratic account. We instantly blocked the activity, engaged third-party information experts and alerted instrumentality enforcement. Our probe recovered definite idiosyncratic accusation was illegally accessed. We're notifying affected individuals and profoundly regret immoderate interest this causes. Protecting the privateness and information of idiosyncratic information is simply a precedence for america and we've added caller layers of information and monitoring connected apical of the broad protections already successful place. We'll besides proceed advancing our defenses against evolving threats."

Warning signs uncover the fake extortion email

Wayne's connection contains respective signs of a bluff. First, it came from an unrelated address. The sender offered nary screenshot, stolen record oregon different grounds of access. Meanwhile, the connection demanded cryptocurrency and imposed a 48-hour deadline. It warned Wayne against contacting constabulary and told him not to reset his devices. Those instructions make panic portion discouraging extracurricular advice.

The sender besides promised to region Wayne's accusation from the acheronian web aft payment. The email provides nary mode to verify that claim. Paying could besides corroborate that the code reaches idiosyncratic consenting to respond. The FTC warns that blackmail emails whitethorn assertion entree to a machine oregon webcam. Some messages see accusation exposed successful a information breach to marque the communicative dependable credible. The bureau advises recipients to debar payment.

COULD THE 7-ELEVEN BREACH AFFECT YOU?

Scammers whitethorn harvester existent breach information with invented webcam threats to unit victims into sending cryptocurrency earlier seeking help. (Photo by Nikolas Kokovlis/NurPhoto via Getty Images)

Clean information scans supply immoderate reassurance

Wayne's cleanable scans enactment the decision that the email contains an bare threat. Still, nary azygous scan tin measure each online relationship tied to an email address. Based connected the connection alone, Wayne has nary crushed to erase oregon factory-reset his devices. The concern changes if helium clicked a link, opened an attachment oregon installed software.

Therefore, the adjacent measurement involves checking accounts alternatively than wiping devices. Review the caller sign-in past for your email account. Then inspect forwarding settings and inbox rules for thing unfamiliar. A transgression with email entree whitethorn make a regularisation that secretly sends copies of your messages elsewhere.

Ways to enactment harmless from sextortion email scams

A fake menace inactive deserves a calm information check. These steps tin assistance you adjacent imaginable openings and hole for follow-up scams.

1) Do not wage oregon reply to the sender

Do not nonstop cryptocurrency. Avoid replying to the email arsenic well. A effect confirms that idiosyncratic reads the address. It whitethorn promote the scammer to summation the unit oregon nonstop different demand.

2) Report and delete the sextortion email

Wayne did the close happening by forwarding the connection to [email protected]. The Anti-Phishing Working Group accepts suspicious emails for investigation and archiving. When your email work allows it, guardant the archetypal connection arsenic an attachment. That method preserves much method information. You tin besides study the connection done the FTC's ReportFraud website astatine reportfraud.ftc.gov/ and the FBI's Internet Crime Complaint Center astatine ic3.gov/. IC3 accepts reports involving cyber-enabled fraud, online scams and different net crimes. After reporting it, people the email arsenic phishing oregon spam. Then delete it.

3) Secure your Carnival and email accounts

Carnival's nationalist announcement omits relationship passwords from its database of exposed information. Even so, alteration your Carnival oregon Holland America password if you reused it determination else. Your email relationship deserves other attraction due to the fact that password reset messages often onshore there. Use a long, unsocial password and crook connected two-factor authentication. A trusted password manager tin make and store unsocial passwords. That prevents 1 exposed password from unlocking respective accounts.

4) Check sign-ins and hidden email forwarding

Open your email provider's information leafage and reappraisal caller logins. Look for devices oregon locations that you bash not recognize. Check the dates and times arsenic well. Next, cheque automatic forwarding and inbox rules. Remove thing unfamiliar. Then alteration the password and motion retired of different sessions.

WHAT A SCAMMER SEES THE MOMENT THEY GOOGLE YOUR NAME

Carnival said attackers copied immoderate customers’ idiosyncratic accusation aft gaining unauthorized entree to an worker relationship successful April 2026. (Patrick Connolly/Orlando Sentinel/Tribune News Service/Getty Images)

5) Watch for individuality theft aft the Carnival breach

Carnival said immoderate exposed records contained authorities recognition numbers. Anyone who received a breach announcement should work it cautiously and usage the offered recognition monitoring erstwhile eligible. Review slope and recognition paper statements for unfamiliar activity. You should besides cheque your recognition reports. For stronger protection, see a recognition frost with each 3 large bureaus. CyberGuy's online information checklist astatine cyberguy.com explains much steps you tin instrumentality aft your accusation appears successful a breach.

6) Remove your idiosyncratic accusation from the web

Scammers often harvester breach information with details from people-search sites and information brokers. That probe tin uncover your address, telephone number, age, relatives oregon erstwhile locations. Removing those records cannot halt each scam. However, it tin trim the accusation criminals usage to personalize aboriginal messages. A information removal work tin taxable requests to information brokers connected your behalf and proceed checking for accusation that reappears. Check retired my apical picks for information removal services and get a escaped scan to find retired if your idiosyncratic accusation is already retired connected the web by visiting Cyberguy.com

7) Use beardown antivirus protection

Wayne's email contained nary nexus oregon attachment successful the transcript helium shared. Future scam messages whitethorn see both. Strong antivirus extortion tin pass you astir malicious websites and phishing pages. It whitethorn besides emblem unsafe downloads oregon scan supported devices for malware. Even with information software, debar links and attachments successful alarming messages. Instead, benignant the company's authoritative web code into your browser. Get my picks for the champion 2026 antivirus extortion winners for your Windows, Mac, Android & iOS devices astatine Cyberguy.com

When a sextortion email requires much action

Take stronger enactment erstwhile you interact with the message.

• Change exposed passwords instantly if you entered them connected a linked page. Use a trusted instrumentality for the change. Then interaction the affected institution done its authoritative website.
• Run updated information scans if you opened an attachment oregon installed software. Also region unfamiliar apps and reappraisal browser extensions.
• If you sent cryptocurrency, interaction the speech oregon outgo supplier close away. A crypto transportation tin beryllium hard to reverse. However, the supplier whitethorn papers the fraud oregon emblem the receiving wallet.

Wayne reported nary clicks oregon downloads. His scans besides recovered nary problems. Based connected those facts, the connection appears to trust connected leaked accusation and fearfulness alternatively than instrumentality access.

Kurt's cardinal takeaways

Wayne handled the menace correctly. He avoided payment, checked his devices and reported the email earlier fearfulness could instrumentality over. The Carnival breach whitethorn explicate however the sender connected Wayne to the cruise company. Still, the connection offered nary impervious that anyone accessed his camera, microphone oregon computer. Scammers often usage 1 close item to marque a overmuch larger prevarication consciousness believable. Secure the accounts tied to the exposed email code and reappraisal caller sign-ins for thing unfamiliar. Most importantly, dilatory down earlier reacting to an urgent demand. Once you look for existent evidence, threats similar this often statesman to autumn apart.

Have you received a threatening email that utilized existent details astir you? Write to america and archer america what it claimed successful the comments beneath truthful we tin assistance different readers spot the informing signs. Let america cognize by penning to america astatine Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

• Get my champion tech tips, urgent information alerts and exclusive deals delivered consecutive to your inbox.
• For simple, real-world ways to spot scams aboriginal and enactment protected, sojourn CyberGuy.com - trusted by millions who ticker CyberGuy connected TV daily.
• Plus, you'll get instant entree to my Ultimate Scam Survival Guide escaped erstwhile you join.

Copyright 2026 CyberGuy.com. All rights reserved.