Carnival Corporation Data Breach Notice (Oregon Attorney General)

The filing from Carnival Corporation confirms that personal information belonging to 5,997,277 people was exposed in an incident that occurred on April 10, 2026. The company submitted its formal notice to the Oregon Department of Justice on May 27, 2026 — 47 days later.

No passwords or login credentials were exposed

This is important. The record lists only personal information. There is no indication that passwords, payment card numbers, or any permanent government identifiers such as Social Security numbers were involved. That removes the most immediate account takeover risk that many people fear after receiving a breach letter.

What the exposed personal information still enables

Even without credentials, the data remains useful to identity thieves and fraudsters. Names combined with addresses, phone numbers, email addresses, or dates of birth can be used to craft convincing phishing messages, apply for credit in someone else’s name using synthetic identity techniques, or impersonate customers in calls to customer service. Because this volume of records — nearly six million — represents a significant portion of Carnival’s customer base, the information is now likely circulating among criminals who buy and sell such lists.

The exposure is permanent in a practical sense. While the company cannot reissue your name, date of birth, or historical address information, you retain control over how that data is used going forward.

How to determine whether your information was included

Carnival is required to notify affected individuals directly, usually by mail to the address they have on file. If you have not received a letter, it is likely that your records were not part of this incident. However, if you have moved since April 10, 2026, or if your contact details held by Carnival are outdated, a letter may never have reached you. In that case, contact Carnival’s customer service directly and ask whether your booking or loyalty account was among those affected.

The value of this data does not expire quickly

Unlike a credit card that can be canceled, personal details such as address history and contact information retain their usefulness for years. Criminals can combine them with data from other breaches to build more complete profiles. The 47-day gap between the incident and the filing does not tell us how long the data may have been accessible before Carnival detected and contained the event. What matters now is that the information is out.

Why the scale matters

With almost six million people notified across multiple states, this ranks among the larger travel-industry incidents in recent years. The sheer volume increases the chance that your information will be packaged and sold on underground markets. At the same time, the absence of passwords or financial account numbers in the disclosed categories limits the immediate danger compared with breaches that expose login details or payment information.

What you can still control

You cannot change the fact that the data exists in the hands of unknown parties. You can reduce the harm it can cause. Focus on the parts of your identity that remain changeable and monitorable.

• Place a fraud alert or credit freeze with the three major credit bureaus. This forces lenders to verify your identity before opening new accounts and is one of the most effective steps you can take after any breach involving personal information.
• Monitor your accounts and statements for unfamiliar charges or changes, especially on any Carnival-related loyalty account or linked travel bookings.
• Be extremely cautious with unsolicited contact claiming to be from Carnival, your bank, or travel partners. Use only contact details you look up yourself rather than numbers or links provided in emails or calls.
• Consider identity theft protection services that include dark-web monitoring for your name, email addresses, and phone numbers. While not a guarantee, these services can alert you if the exposed data surfaces in new places.
• Review your annual credit reports from Equifax, Experian, and TransUnion at least once every four months. Look for accounts or inquiries you do not recognize.

The letter you may have received is the most reliable indicator of whether you were directly affected. For everyone else, the precautions above address the realistic risks created by the exposure of personal information at this scale. The incident does not put your existing Carnival account at direct risk of takeover, but it does mean your details are now more widely available to people who may try to exploit them over the coming months and years.