Carnival breach exposes nearly six million customers' personal information
An attacker deceived a Carnival employee and stole customer information, including government ID numbers. Nearly six million customers were notified. Read your notice, monitor accounts and use the free credit monitoring if eligible.
Read your Carnival notification to see what information was involved and how to enrol in free monitoring if eligible. Regularly check account statements and credit reports; US residents can also consider freezing their credit with Equifax, Experian and TransUnion. Report suspected identity theft to local police.
What’s happening
An attacker deceived a Carnival employee to access company systems in April 2026. Carnival's notification filing identified 5,995,277 affected customers. Information varied by person and included names, contact details, dates of birth, passport numbers and driving licence numbers. Carnival says it stopped the access on 14 April and knew of no further unauthorised activity when it issued its May notice. Separately, Have I Been Pwned reported a public release containing 7.5 million unique email addresses and Holland America loyalty details; that figure measures email addresses rather than Carnival's notified customers. ShinyHunters claimed responsibility, without confirmation from Carnival. Texas announced an investigation on 22 June. As at 3 November, the sources reviewed provide no later investigation outcome or confirmation that the stolen information was recovered or deleted.
- What
- Breach
- Affects
- Carnival Corporation customer information, including Holland America loyalty records
- Fixed in
- Nothing to patch
- Since
- 10 Apr 2026
- Closed
- 22 June 2026
Timeline
- Update
Texas Attorney General Ken Paxton announced an ongoing investigation into Carnival's data safeguards. His office said 800,060 Texans were affected and that it had issued a formal demand for information.
- Update
BleepingComputer reported that Carnival's Maine filing identified 5,995,277 affected customers. ShinyHunters claimed responsibility, but Carnival had not attributed the attack.
- Made public
Carnival began individual notifications and offered affected US individuals two years of free TransUnion credit monitoring.
- Made public
Have I Been Pwned added the breach, reporting publicly released data containing 8.7 million records and 7.5 million unique email addresses. It identified Holland America's Mariner Society loyalty information in the data.
- Update
Carnival established that personal information had been copied.
- Update
Carnival detected and stopped unauthorised access through an employee account. An attacker had deceived the employee into providing access to part of its systems.
- UpdateNothing to patch
The breach began on 10 April, according to Carnival's notification filing reported by BleepingComputer.
Sources
- Carnival Corporation Notice of Data BreachCarnival Corporation · 27 May 2026
- Carnival Cruise confirms data breach affecting nearly 6 million peopleBleepingComputer · 28 May 2026
- Carnival Corporation contacts clients after data breachTravel Weekly · 28 May 2026
- Carnival Data BreachHave I Been Pwned · 24 Apr 2026
- Attorney General Paxton Announces Ongoing Investigation into Carnival Cruise Line Over Data BreachTexas Attorney General · 22 June 2026