Carnival Corporation Data Breach Notice (Washington Attorney General)

The April 10, 2026 breach at Carnival Corporation has placed the names, full dates of birth, driver's license or Washington ID card numbers, and passport numbers of 54,960 people into unknown hands. If you received a letter from the company, this filing means those details were among the information exposed.

Your Name and Date of Birth Are Now Permanent Public Currency

Full date of birth combined with name is one of the most reliable long-term anchors used in identity theft. Unlike a credit card or password, neither can be replaced. Criminals can use this pair for years to open accounts, file fraudulent tax returns, or build synthetic identities. The addition of a driver's license or Washington ID number and a passport number makes the package significantly more valuable because these are primary government identifiers that many organisations treat as proof of identity.

The filing lists exactly these four categories. No passwords, no financial account numbers, and no medical information appear in the record. That absence is meaningful: there is no credential exposure here, so you do not need to change any Carnival passwords as a result of this incident.

What the 47-Day Gap Actually Tells You

Carnival Corporation discovered or placed the incident date on April 10, 2026 and filed the notice with the Washington Attorney General on May 27, 2026. The 47-day interval is neither unusually fast nor unusually slow under current state notification rules. The record contains no discovery date, so it is not possible to know how long the data may have been accessible before the company became aware of the problem. The only dates that exist are the incident date and the filing date.