The threat actor known as ShinyHunters posted simultaneous claims of data theft from three major global consumer brands on dark web forums on 21 April 2026: Inditex (parent company of Zara), Carnival Corporation, and 7-Eleven. The group published sample datasets as authentication of their claims and set extortion deadlines after which they state the full data will be released publicly. No organisation has confirmed the breaches as of publication.
ShinyHunters’ Track Record
ShinyHunters is one of the most prolific and operationally consistent data theft and extortion actors documented since 2020. The group’s confirmed breaches include Tokopedia (91 million records), Wishbone (40 million records), multiple Microsoft GitHub repositories, and the 2024 AT&T breach containing 73 million customer records. When ShinyHunters publishes a claim with sample data, that sample has consistently proven authentic in subsequent investigations. Their false positive rate across public claims with samples is negligible.
This track record does not make the April 21 claims confirmed — organisations have a right to investigate before disclosing — but it means treating these claims as speculative or low-credibility would be operationally irresponsible. Security teams at organisations with data relationships to any of the three companies should act on the assumption that data was compromised pending the outcome of forensic investigation.
The Three Claims
ShinyHunters posted the three claims in a single forum thread on 21 April, which may indicate a coordinated campaign or may reflect batch posting of access obtained over a preceding period. The claimed data types:
Inditex / Zara: Customer PII including email addresses, physical mailing addresses, and loyalty programme membership data. Inditex operates Zara.com’s e-commerce platform across 96 markets; the customer base is global.
Carnival Corporation: Passenger booking records, passport numbers, and payment card information. Carnival operates nine cruise line brands globally. The combination of passport numbers and payment card data is particularly high-impact — it enables identity fraud at a category not addressable by credit monitoring alone.
7-Eleven: Employee and franchisee operational data, including compensation details and internal business records. This data type creates HR-specific fraud vectors and may expose franchisee financial arrangements.
Regulatory Exposure by Entity
Each organisation operates under distinct data protection obligations:
- Inditex: Headquartered in Spain; European customer data falls under GDPR. A confirmed breach affecting EU residents triggers 72-hour supervisory authority notification under Article 33. Inditex’s scale means multiple national supervisory authorities are likely notifiable.
- Carnival Corporation: US-headquartered but carrying passengers across jurisdictions. Payment card data triggers PCI DSS breach notification to card brands and acquirers, typically within 24–72 hours of a confirmed breach determination. Passport data triggers state-level biometric or government identifier notification laws in several US states.
- 7-Eleven: US and international operations; employee data falls under multiple state employment data protection frameworks. Franchisee data may involve business-to-business contractual notification obligations in addition to statutory ones.
What Security Teams at Partner Organisations Should Do
Organisations with data relationships to any of the three companies — HR payroll integrators, loyalty programme partners, vendor data recipients, or companies sharing customer lists — should:
- Assess indirect data exposure: Determine whether your organisation’s employee data, customer lists, or business records were shared with any of the three companies through vendor, partner, or operational relationships
- Review data sharing agreements: Confirm whether breach notification obligations exist in contracts with these companies that would require them to notify you if customer or employee data you shared was exposed
- Brief CISO and legal: Treat the claims as requiring proactive monitoring rather than a wait-and-see posture
For the Directly Affected Organisations
- Begin forensic investigation immediately: ShinyHunters primarily gains access through compromised API credentials, misconfigured cloud storage, and SQL injection in web-facing applications; investigation scope should cover all three
- Assess PCI DSS breach notification timelines: For Carnival, confirmed payment card exposure triggers card brand and acquirer notification within 24–72 hours regardless of full breach scope determination
- Do not negotiate without legal guidance: Payments to data extortion groups carry regulatory and legal risk across jurisdictions; engage counsel before considering any response to extortion demands
- Communicate proactively: The dark web posting is public. Customers and employees are more likely to learn of the claims from security news coverage than from the companies themselves if proactive communication is delayed — that sequence damages trust more than an early notification.
Share this article