What an Attacker Can Do With Your Exposed Identity Data - Cybersecurity Insiders

In April 2026, Carnival Corporation discovered an attacker had deceived an employee into granting system access. By late May, when notification letters were sent, the breach had affected nearly six million customers. While the group ShinyHunters claimed responsibility for 8.7 million records, Carnival's own disclosure confirmed the breach method involved deception rather than technical exploits. The stolen data included names, home addresses, dates of birth, phone numbers, driver's license numbers, and passport numbers.

Targeting Potential

The exposed data becomes particularly dangerous when combined with publicly available information. A simple LinkedIn profile listing a person's name, employer, and title, when added to the breached data and information from public data brokers, creates a complete targeting dossier. With AI, attackers can sort six million victims by employer in an afternoon, prioritizing those working at banks, hospitals, utility companies, or defense contractors.

These high-value targets now have phone numbers that can be spoofed and personal details that can pass help desk identity verification checks. The 2026 Threat Hunting Report from CrowdStrike found vishing attacks rose 134% from 2024 to 2025 and doubled again in the first half of 2026.

Deepfake Deception

In 2024, engineering firm Arup fell victim to a deepfake scam where attackers impersonated the CFO and colleagues using harvested voice, image, and video samples. The convincing deepfake resulted in approximately $25 million being siphoned from Arup's accounts before the fraud was detected. Similar attacks against MGM Resorts and Caesars in 2023 involved attackers calling IT help desks impersonating employees armed with public profile details.

The way in was a phone call and enough identity data to pass as the employee. No software was exploited.

Preventive Challenges

MITRE's ATT&CK framework addresses this problem under technique T1589, Gather Victim Identity Information, which has no real preventive controls. The guidance suggests keeping less identity data publicly available. Companies should assess their identity verification questions by checking if strangers could answer them using LinkedIn or data broker sites in twenty minutes.

Solutions like VanishID aim to provide visibility into exposed digital identities, helping organizations predict who is most likely to be targeted and giving traditional security controls a predictive edge against attackers.