Carnival Discloses Breach Impacting Nearly 6M Travelers
Carnival Corporation notified customers of a cybersecurity incident first detected on April 14, 2026. An unauthorized actor used social engineering to compromise an employee account and access a limited portion of the IT system, resulting in the copying of customer and employee data. Notifications began around May 27 with offers of credit monitoring.
- names
- addresses
- dates of birth
- phone numbers
- passport numbers
- driver's license numbers
Carnival Corporation disclosed on May 31, 2026 that a cybersecurity incident had exposed the personal information of nearly 6 million travelers. The breach, first detected on April 14, 2026, occurred after an unauthorized actor used social engineering to compromise an employee account and gain access to a limited portion of the company’s IT systems. Customer records containing names, addresses, dates of birth, phone numbers, passport numbers, and driver’s license numbers were copied.
Public reporting indicates the cruise operator began notifying affected individuals around May 27. The company stated that the intruder accessed only a specific subset of its network and that the data was exfiltrated rather than altered or deleted. Notifications included an offer of credit monitoring services. Industry research from sources such as DoxxScan™ continuous monitoring indicates that travel-sector breaches frequently expose combinations of identity documents and contact details that retain long-term value on underground markets.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary Warden™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15.4B+ leaked records (including this breach) in 15 seconds — then show you the $19 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →
