Summary (tl;dr)

Carnival Corporation has confirmed a data breach that occurred in April 2026, affecting nearly 6 million individuals whose personal information, including government-issued identification numbers, was stolen by the ShinyHunters hacking group.

Essential Background

Carnival Corporation, the world's largest cruise company, has a history of cybersecurity incidents, having reported multiple data breaches since 2019, including ransomware and phishing attacks. Previous incidents have led to regulatory penalties, such as a $1.25 million fine.

The Full Story

The recent data breach was identified on April 14, 2026, when Carnival's IT security team detected unauthorized activity involving an employee's account. An attacker utilized social engineering tactics to gain access to a limited portion of the company's IT systems. By April 22, 2026, Carnival confirmed that personal information had been illegally copied from its systems.

The ShinyHunters cybercrime group claimed responsibility for the attack in April 2026, alleging they stole over 8.7 million records and subsequently made data publicly available after ransom negotiations failed. Carnival has since confirmed that 5,995,277 individuals were affected. The compromised data varies by individual but generally includes names, addresses, dates of birth, email addresses, phone numbers, and government-issued identification numbers, such as driver's license and passport numbers. Carnival began notifying affected individuals on May 27, 2026, and is offering two years of complimentary credit monitoring services.

Why It Matters

This latest breach puts nearly 6 million Carnival customers at significant risk of identity theft, phishing scams, and other fraudulent activities due to the highly sensitive nature of the exposed personal and identification data. For Carnival Corporation, this recurring issue amplifies concerns regarding its cybersecurity measures, potentially leading to increased regulatory scrutiny, substantial fines under data protection laws like GDPR and CCPA, and further legal challenges, as evidenced by multiple class-action lawsuits already filed. The repeated breaches also risk eroding consumer trust and could negatively impact booking revenues across its various cruise brands.

Geographic Location

• Doral, Florida, United States (Carnival Corporation's operational headquarters)
• Maine, United States (state attorney general's office where breach notifications were filed)
• Southern District of Florida, United States (location where class-action lawsuits related to the breach were filed)