Carnival announced a data breach that could impact up to 6 million customers of the cruise line.
According to a notice posted on its website on May 27, Carnival Corporation said its IT department discovered a cybersecurity breach on April 14.
“An unauthorized actor used social engineering to deceive an employee to gain access to a limited portion of the company’s IT system,” Carnival wrote.
The unauthorized person was able to access customers’ names, addresses and government-issued identification numbers -- driver’s license and passport numbers -- the company said.
A data breach at Carnival exposed personal details of nearly 6 million customers. Here's what you should know about the incident. https://t.co/QZS4Akt6Tc
— USA TODAY (@USATODAY) June 2, 2026
According to Carnival, the company “acted swiftly” to block the activity and coordinated with “third-party security experts” to launch an investigation and beef up its security systems, USA Today reported.
Carnival has not publicly disclosed how many customers’ information may have been compromised by the data breach, but a filing with the Maine Attorney General’s Office put the number at 5,995,277. The filing also noted that the breach occurred on April 10.
Tim Howard, managing partner of Fortify Experts, a Houston-based cybersecurity consulting firm, told KPRC that the attack shows a growing trend in cyber crimes.
“That particular breach occurred through social engineering,” Howard told the television station. “They acted like they were somebody else, like an administrator who got locked out, and they convinced the individual on the other side to open a door for them to get in.”
Howard added that the growing influence of artificial intelligence is making cyberattacks more sophisticated.
“We used to have a very small group of hackers that could go after you,” Howard told KPRC. “Now, anybody can be a hacker. Anybody can learn how to socially engineer.”
Carnival wrote that it regretted the information breach.
“Carnival Corporation values the trust you place in us, and we take the privacy and security of your information very seriously,” the company wrote in its notice. “We deeply regret this incident and any concern it may cause and have sent notification letters to individuals whose data was impacted.”
Carnival said it is offering customers affected by the data breach two free years with TransUnion, a credit monitoring company, USA Today reported.
Carnival said it has set up a call center for customers with questions about the data breach and TransUnion services the company is offering. Consumers can call 1-844-593-8310, from 8 a.m. to 8 p.m. ET Monday through Friday.
“The company will continue to advance its IT security and data privacy controls to stay ahead of an ever-evolving threat landscape,” Carnival wrote in its news release.
© 2026 Cox Media Group
