{"id":"carnival-customer-data-breach-apr-2026","category":"breach","status":"closed","title":"Carnival breach exposes nearly six million customers' personal information","tldr":"An attacker deceived a Carnival employee and stole customer information, including government ID numbers. Nearly six million customers were notified. Read your notice, monitor accounts and use the free credit monitoring if eligible.","summary":"An attacker deceived a Carnival employee to access company systems in April 2026. Carnival's notification filing identified 5,995,277 affected customers. Information varied by person and included names, contact details, dates of birth, passport numbers and driving licence numbers. Carnival says it stopped the access on 14 April and knew of no further unauthorised activity when it issued its May notice. Separately, Have I Been Pwned reported a public release containing 7.5 million unique email addresses and Holland America loyalty details; that figure measures email addresses rather than Carnival's notified customers. ShinyHunters claimed responsibility, without confirmation from Carnival. Texas announced an investigation on 22 June. As at 3 November, the sources reviewed provide no later investigation outcome or confirmation that the stolen information was recovered or deleted.","action":"Read your Carnival notification to see what information was involved and how to enrol in free monitoring if eligible. Regularly check account statements and credit reports; US residents can also consider freezing their credit with Equifax, Experian and TransUnion. Report suspected identity theft to local police.","product":"Carnival Corporation customer information, including Holland America loyalty records","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["carnival","holland-america","data-breach","identity-theft","social-engineering"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Carnival Corporation Notice of Data Breach","url":"https://www.carnivalcorp.com/wp-content/uploads/2026/05/Website-Notice-Substitute-Notice-05.27.26.pdf?pubDate=20260604","by":"Carnival Corporation","date":"2026-05-27"},{"kind":"news","title":"Carnival Cruise confirms data breach affecting nearly 6 million people","url":"https://www.bleepingcomputer.com/news/security/carnival-cruise-confirms-data-breach-affecting-nearly-6-million-people/","by":"BleepingComputer","date":"2026-05-28"},{"kind":"news","title":"Carnival Corporation contacts clients after data breach","url":"https://travelweekly.co.uk/news/carnival-corporation-contacts-clients-after-data-breach","by":"Travel Weekly","date":"2026-05-28"},{"kind":"research","title":"Carnival Data Breach","url":"https://haveibeenpwned.com/Breach/Carnival","by":"Have I Been Pwned","date":"2026-04-24"},{"kind":"advisory","title":"Attorney General Paxton Announces Ongoing Investigation into Carnival Cruise Line Over Data Breach","url":"https://www.texasattorneygeneral.gov/news/releases/attorney-general-paxton-announces-ongoing-investigation-carnival-cruise-line-over-data-breach","by":"Texas Attorney General","date":"2026-06-22"}],"started":"2026-04-10","closed":"2026-06-22","created":"2026-11-03T20:21:51.096Z","updated":"2026-11-03T20:21:51.096Z","cve_notes":[],"timeline":[{"at":"2026-06-22","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Texas Attorney General Ken Paxton announced an ongoing investigation into Carnival's data safeguards. His office said 800,060 Texans were affected and that it had issued a formal demand for information.","url":"https://www.texasattorneygeneral.gov/news/releases/attorney-general-paxton-announces-ongoing-investigation-carnival-cruise-line-over-data-breach","by":"Texas Attorney General","patch":null},{"at":"2026-05-28","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"BleepingComputer reported that Carnival's Maine filing identified 5,995,277 affected customers. ShinyHunters claimed responsibility, but Carnival had not attributed the attack.","url":"https://www.bleepingcomputer.com/news/security/carnival-cruise-confirms-data-breach-affecting-nearly-6-million-people/","by":"BleepingComputer","patch":null},{"at":"2026-05-27","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"Carnival began individual notifications and offered affected US individuals two years of free TransUnion credit monitoring.","url":"https://www.carnivalcorp.com/wp-content/uploads/2026/05/Website-Notice-Substitute-Notice-05.27.26.pdf?pubDate=20260604","by":"Carnival Corporation","patch":null},{"at":"2026-04-24","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"Have I Been Pwned added the breach, reporting publicly released data containing 8.7 million records and 7.5 million unique email addresses. It identified Holland America's Mariner Society loyalty information in the data.","url":"https://haveibeenpwned.com/Breach/Carnival","by":"Have I Been Pwned","patch":null},{"at":"2026-04-22","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Carnival established that personal information had been copied.","url":"https://www.carnivalcorp.com/wp-content/uploads/2026/05/Website-Notice-Substitute-Notice-05.27.26.pdf?pubDate=20260604","by":"Carnival Corporation","patch":null},{"at":"2026-04-14","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Carnival detected and stopped unauthorised access through an employee account. An attacker had deceived the employee into providing access to part of its systems.","url":"https://www.carnivalcorp.com/wp-content/uploads/2026/05/Website-Notice-Substitute-Notice-05.27.26.pdf?pubDate=20260604","by":"Carnival Corporation","patch":null},{"at":"2026-04-10","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"The breach began on 10 April, according to Carnival's notification filing reported by BleepingComputer.","url":"https://www.bleepingcomputer.com/news/security/carnival-cruise-confirms-data-breach-affecting-nearly-6-million-people/","by":"BleepingComputer","patch":"na"}],"url":"https://hard.fyi/live/carnival-customer-data-breach-apr-2026/","json":"https://hard.fyi/api/live?id=carnival-customer-data-breach-apr-2026"}