AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Last Update: 10/27/2026 at 6:00 AM EST
Carnival Data Breach
Coverage from Ship Universe, Morgan & Morgan, and others
Carnival Corporation’s 2026 data breach involved social engineering that gave an attacker access to part of the company’s internal IT environment.
The company reported that personal information belonging to nearly six million people was copied or exposed, with reported data including names, contact details, birth dates, loyalty information, and potentially government-issued identifiers. The incident led to customer notifications, credit monitoring and fraud-assistance arrangements through TransUnion and its partners, scrutiny from authorities including Texas enforcement, and questions about security across Carnival’s cruise brands. Reported claims involving ShinyHunters and related legal actions form part of the incident’s wider aftermath.
Looking Back
106 Day Timeline
Apr 19
May 7
May 25
Jun 12
Jun 27
Jul 15
Aug 2
All Articles81 articles
Important
Cruise operators are advised to secure passenger identity, payment, and guest app systems to prevent fleetwide privacy harms after a major data breach.
7/23/2026 • Personal Data & Identity • General
Carnival Corporation disclosed a 2026 incident on April 14, 2026, where social engineering enabled unauthorized access and illegal copying of customer personal data potentially affecting about six million people.
7/7/2026 • Data Breaches & Exposure Events • General
Texas Attorney General Ken Paxton announced an investigation into Carnival after an April 2026 breach exposed personal information of about 800,000 Texas consumers.
6/24/2026 • Regulation, Law & Enforcement • General
Ken Paxton announced a Texas investigation into Carnival Corporation after a socially engineered employee-account breach exposed personal information for hundreds of thousands of Texas consumers in April 2026.
6/24/2026 • Data Breaches & Exposure Events • General
Texas Attorney General Ken Paxton announced an investigation of Carnival Corporation in Austin after an April 2026 breach exposed personal data affecting 800,060 Texas residents.
6/23/2026 • Data Breaches & Exposure Events • General
Ken Paxton is investigating Carnival in Texas after a reported April data breach exposed personal information of 800,060 Texas consumers, with notification filed 44 days later.
6/23/2026 • Data Breaches & Exposure Events • General
Texas Attorney General Ken Paxton announced an investigation into Carnival Corporation after an April 2026 social-engineering data breach exposed about six million people.
6/22/2026 • Data Breaches & Exposure Events • General
Ken Paxton announced a Texas investigation into Carnival Corporation after an April 2026 breach exposed consumer information for 800,060 Texas residents.
6/22/2026 • Data Breaches & Exposure Events • General
Texas Attorney General Ken Paxton announced an investigation into Carnival Corporation after an April 2026 breach exposed personal information for 800,060 Texans.
6/22/2026 • Data Breaches & Exposure Events • General
Ken Paxton launched a Texas investigation on June 22, 2026 into Carnival Corporation after a 2026 breach exposed customer data and notification occurred 44 days later.
6/22/2026 • Data Breaches & Exposure Events • General
Ken Paxton announced an investigation in Texas into Carnival Corporation after an April 2026 data breach exposed personal information for 800,060 Texans.
6/22/2026 • Data Breaches & Exposure Events • General
Texas Attorney General Ken Paxton launched a data-breach investigation into Carnival after a social-engineering incident compromised an employee account and exposed 800,060 Texas residents.
6/22/2026 • Data Breaches & Exposure Events • General
Slater Vecchio filed a Canadian class action in British Columbia on June 17, 2026, alleging Carnival Corporation mishandled an April 14 breach involving exposed personal identifiers.
6/19/2026 • Data Breaches & Exposure Events • General
Susan Geiner filed a May 28 Nevada class action against Station Casinos after a March 5 breach allegedly exposed customers and employees and was disclosed to the Maine Attorney General on May 21.
6/3/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed on May 27 a data breach discovered April 14 in the USA|Maine, involving social engineering and exposure of passenger identity documents.
6/2/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed a passenger data breach on May 27 after a social engineering intrusion detected April 14 and customer data exposure determined April 22.
6/2/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed an April data breach in U.S. customer filings, began May 27 notifications, and partnered with TransUnion for two years of credit monitoring.
6/1/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed April 14 breach impacts on millions, including Texas cruise passengers, after a targeted employee-access attack.
6/1/2026 • Data Breaches & Exposure Events • General
Carnival Corporation reported a social-engineering data breach discovered April 14, 2026, with Maine Attorney General notification covering 5,995,277 affected individuals.
5/31/2026 • Data Breaches & Exposure Events • General
Carnival Corporation reported April 14 unauthorized access via a social-engineered employee account compromised, exposing passport and driver license data and prompting a Maine Attorney General notice for 5,995,277 people.
5/31/2026 • Data Breaches & Exposure Events • General
Carnival Cruise Line disclosed in 2020s timeframe that social engineering compromised an employee account in April, exposing names, addresses, and government IDs, with U.S. credit monitoring offered via TransUnion.
5/31/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed an April data breach tied to social engineering and offered TransUnion credit monitoring after exposure of nearly 6 million customers’ personal data.
5/30/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed a phishing-driven data breach discovered April 14, 2026 and linked to Mariner Society after ShinyHunters extortion, with notifications sent May 27, 2026.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed a 5,995,277-customer data breach beginning April 10, 2026, after social-engineering credential compromise and notifications starting May 27.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corporation notified Maine and nearly 6 million people after social engineering enabled an employee account compromise and exposure of identity data starting April 14, 2026.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corporation detected an April 14, 2026 social engineering attack exposing personal data for about 5.99 million people, leading to class action investigation.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corporation notified Maine and other audiences in 2026 after an April 2026 intrusion copied personal data from Carnival IT systems.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corporation reported April 2026 discovery of a social-engineering-driven breach after attackers accessed internal systems and copied data affecting 5,995,277 individuals.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed in April 2026 that a social engineering breach exposed personal information, after which scammers targeted recipients including Wayne P. in Evangeline, Louisiana.
8/2/2026 • Data Breaches & Exposure Events • General
Carnival confirmed in May that a ShinyHunters-linked April attack led to copying passenger passport and driver license data after an employee account compromise.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed a phishing-driven employee account compromise on April 14, 2026, with Maine breach notification for 5,995,277 people starting May 27.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corporation notified nearly 6 million customers in April 2026 after a social-engineering-driven intrusion enabled ShinyHunters-linked data theft and extortion.
5/28/2026 • Data Breaches & Exposure Events • General
Interesting
Ken Paxton investigated Carnival Corporation in Texas after an April data breach exposed personal information of 800,060 Texans, with breach notice submitted 44 days later.
6/23/2026 • Data Breaches & Exposure Events • General
Carnival Corporation reported a social-engineering attack on April 14, 2026, leading to unauthorized access and guest notifications with free credit monitoring.
6/4/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed a social-engineering cyber breach discovered April 14 and confirmed customer data compromise by April 22, with notifications starting May 27.
6/2/2026 • Data Breaches & Exposure Events • General
Carnival Corporation began notifying people on May 27, 2026 after a April 14 social-engineering intrusion exposed personal data, offering TransUnion credit monitoring in the U.S.
5/29/2026 • Data Breaches & Exposure Events • General
Carnival Corporation notified Maine-relevant consumers in 2026 after a April network intrusion exposed personal and loyalty data for about 6 million people.
5/29/2026 • Data Breaches & Exposure Events • General
Carnival Corp reported a April cybersecurity incident involving a compromised employee account, using social engineering to leak personal information and prompting May 27 TransUnion credit-monitoring offers.
5/27/2026 • Data Breaches & Exposure Events • General
Yvonne Vasquez filed a class action against Carnival Corporation in Florida, alleging a 2026 cybersecurity failure exposed unencrypted personal data for about 8.7 million people.
4/28/2026 • Data Breaches & Exposure Events • General
Carnival Inc. disclosed an April 14 unauthorized-access breach that the Texas Attorney General says may have exposed personal data for up to 800,060 Texans.
6/1/2026 • Data Breaches & Exposure Events • General
Carnival Corporation reported an April data breach discovered after unauthorized access to an employee account exposed sensitive personal identifiers for nearly six million people.
5/31/2026 • Data Breaches & Exposure Events • General
Texas Attorney General Ken Paxton announced a Carnival Corporation investigation after an April 2026 data breach involving employee-account deception and consumer data exposure.
6/25/2026 • Data Breaches & Exposure Events • General
Texas Attorney General Ken Paxton announced an investigation into a Carnival Cruise Line cybersecurity incident affecting about 800,000 Texans, involving customer identity data.
6/23/2026 • Data Breaches & Exposure Events • General
A Nevada woman filed a class action against Station Casinos over a reported March 2026 data breach involving undisclosed personal-data exposure details.
6/8/2026 • Data Breaches & Exposure Events • General
Carnival Corporation reported a cybersecurity breach discovered in 2026 after an April 2026 incident exposed personal information of nearly 6 million customers.
6/2/2026 • Data Breaches & Exposure Events • General
Carnival Corporation reported a 6 million-cruiser data breach in response to social engineering that enabled unauthorized access to an employee-linked account.
6/2/2026 • Data Breaches & Exposure Events • General
Carnival Corporation notified customers in May 2026 about an April 2026 incident involving employee-account social engineering and offered TransUnion credit monitoring to U.S. customers.
6/2/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed a social engineering intrusion on an unspecified date that exposed passenger dates of birth and passport numbers.
6/1/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed an April data breach after social engineering enabled unauthorized system access, exposing passenger dates of birth and passport numbers.
6/1/2026 • Data Breaches & Exposure Events • General
Carnival Corporation notified nearly 6 million customers in a data breach announced after an April social engineering attack.
6/1/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed that a April social-engineering attack led to unauthorized access to passenger passport numbers and dates of birth.
6/1/2026 • Data Breaches & Exposure Events • General
Carnival Corporation reported a April 14 incident after social engineering compromised an employee account, exposing identity data for 5.99 million people in a Maine Attorney General notice.
5/31/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed May 27 that a social-engineering attack in April may have exposed passport and driver's license numbers for some travelers, including Texas cruise passengers.
5/31/2026 • Data Breaches & Exposure Events • General
Carnival Corporation notified potentially affected individuals in May 2026 after an April 14, 2026 social engineering-driven breach exposed personal information including government ID numbers.
5/29/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed a consumer data breach to Maine officials after April 10 exposure, notifying about 6 million people starting May 27 and offering TransUnion credit monitoring.
5/29/2026 • Data Breaches & Exposure Events • General
Carnival Corporation notified affected individuals beginning May 27 after an April 14 social-engineering attack led to unauthorized access to parts of Carnival IT systems.
5/29/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed a data breach in the U.S. after ShinyHunters claimed access to Mariner Society loyalty data following a phishing compromise detected April 14, 2026.
5/29/2026 • Data Breaches & Exposure Events • General
Carnival Corporation notified the Maine Attorney General's Office after unauthorized employee-account activity exposed personal data for nearly 10,000 Mainers.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corporation confirmed a ShinyHunters ransomware data breach in April 2026 after social engineering compromised an employee device, affecting millions of customers.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corporation filed a Maine Attorney General breach notice in connection with unauthorized employee-account activity affecting nearly 10,000 Mainers.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corp reported a May 27 disclosure of an April cybersecurity incident where social engineering enabled unauthorized access to personal data tied to an employee account.
5/27/2026 • Data Breaches & Exposure Events • General
Carnival Corp announced May 27 that an April employee-account compromise enabled social engineering, exposing personal data and triggering notification and TransUnion credit monitoring.
5/27/2026 • Cybersecurity (Privacy-Relevant) • General
Carnival Corp said a April employee-account compromise used social engineering, exposing personal data including government-issued IDs and triggering May 27 notifications and TransUnion credit monitoring.
5/27/2026 • Data Breaches & Exposure Events • General
Carnival Corporation issued May 27, 2026 data-breach notifications after April 2026 social engineering compromised an employee account and exposed personal identifiers.
5/27/2026 • Data Breaches & Exposure Events • General
Station Casinos notified the Maine Attorney General's Office in 2026 about a March 5 unauthorized access incident affecting at least one Maine resident, with notifications starting May 21.
5/25/2026 • Data Breaches & Exposure Events • General
Station Casinos disclosed a data breach discovered March 5, 2026, to the Maine Attorney General on May 21 and began notifying affected individuals the same day.
5/22/2026 • Data Breaches & Exposure Events • General
Between April 22-24, 2026, three plaintiffs filed class-action lawsuits in Florida against Carnival Corporation over an alleged ShinyHunters-linked breach and delayed notification.
4/30/2026 • Data Breaches & Exposure Events • General
ShinyHunters allegedly accessed Carnival Corporation data and issued a ransom threat, while Carnival reported blocking unauthorized activity and notifying law enforcement.
4/24/2026 • Data Breaches & Exposure Events • General
Carnival Corporation is investigating an extortion-related data breach claim listed by ShinyHunters after unauthorized activity was detected in a single user account, with a deadline expiring April 21, 2026.
4/24/2026 • Data Breaches & Exposure Events • General
ShinyHunters threatened to leak alleged stolen data from Carnival Corporation by April 21, 2026 after Carnival detected suspicious phishing tied activity on one account.
4/19/2026 • Data Breaches & Exposure Events • General
Have I Been Pwned flagged 7.5 million email addresses tied to Carnival Corporation while the company reported a limited phishing compromise.
4/24/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed a reported April 2026 data breach affecting nearly 6 million travelers after social engineering targeted employee accounts.
6/1/2026 • Data Breaches & Exposure Events • General
Carnival Corporation reported on an April 14 employee-account compromise after possible exposure of traveler passport and driver license numbers.
5/31/2026 • Data Breaches & Exposure Events • General
Carnival Corp disclosed on May 27 that a compromised employee account in April exposed personal information including government-issued identification numbers, after social engineering access.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corp. reported an April employee-account compromise using social engineering, exposing personal data and leading to May 27 notifications and TransUnion identity protection for U.S. customers.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corporation disclosed in 2026 a social-engineering-driven data breach affecting 5.99 million U.S. residents and began California filings and consumer notifications with TransUnion credit monitoring.
5/28/2026 • Data Breaches & Exposure Events • General
Carnival Corporation notified individuals after a May 27, 2026 public disclosure, following an April 14, 2026 incident involving social engineering and unauthorized IT access.
5/27/2026 • Data Breaches & Exposure Events • General
Zachary Pottle filed a Florida federal class action on April 22, 2026, alleging Carnival failed to notify customers after ShinyHunters stole over 8.7 million PII records in a ransomware breach on April 18, 2026.
5/25/2026 • Data Breaches & Exposure Events • General
Station Casinos disclosed a March 5, 2026 data breach to the Maine Attorney General on May 21, 2026 and began written consumer notifications.
5/22/2026 • Data Breaches & Exposure Events • General
Ashley Cole filed a class action in Southern District of Florida against Carnival Corporation alleging delayed breach notice after alleged ShinyHunters exfiltration around April 18, 2026.
4/28/2026 • Data Breaches & Exposure Events • General
Carnival Corp said Wednesday that an April social-engineering attack compromised an employee account and exposed personal information, prompting notifications and credit monitoring for affected individuals in the United States.
5/29/2026 • Cybersecurity Tech (Privacy-Relevant) • General