6 Million Cruise Passengers Had Their Data Stolen — Are You One of Them?

If you’ve ever sailed with Carnival Corporation — and that includes brands like Princess Cruises, Holland America, Cunard, Costa, P&O, and AIDA, not just Carnival Cruise Line itself — there’s a real chance your personal information was swept up in a major data breach disclosed this week.

According to a report from Malwarebytes, Carnival Corporation confirmed that 5,995,277 people had their data accessed and copied by an unauthorized actor in April 2026. Notifications began going out to affected individuals on May 27.

What Happened

The breach started on April 14, 2026, when an attacker used social engineering — essentially manipulating a Carnival employee into handing over access — to get a foothold inside the company’s IT systems. By April 22, the attacker was using that compromised account to browse and copy data from “a limited portion” of Carnival’s infrastructure. The company detected and blocked the activity before the end of the month.

The hacker group ShinyHunters has publicly claimed responsibility, and reportedly attempted extortion before threatening to make the stolen data available for download.

What Data Was Taken

The information exposed varies by individual, but the breach notice filed with the state of Maine outlines the following categories:

Full names
Email addresses
Dates of birth
Gender
Mariner Society membership status and tier (Carnival’s loyalty program)
Internal customer identifiers

For some individuals, more sensitive data — including driver’s license numbers and passport numbers — may also have been compromised, according to other regulatory filings.

What Carnival Is Offering

Carnival is offering eligible U.S. residents 24 months of complimentary credit monitoring through TransUnion’s MyTrueIdentity platform, with fraud assistance provided by Cyberscout. The company has stated that it “immediately blocked the activity, engaged third-party security experts and alerted law enforcement” and that “protecting the privacy and security of personal data is a priority.”

If you receive a notification letter, it will include instructions for enrolling in the credit monitoring service.

Why This Should Concern Every Cruise Traveler

Carnival Corporation is the world’s largest cruise operator, running 90 ships across seven major brands. The company served roughly 13.5 million guests in 2025 alone. The scale of this breach — nearly 6 million people — represents a significant slice of its customer base.

What makes this particularly frustrating is that this is not a one-time lapse. Between 2019 and 2021, Carnival reported four separate cybersecurity incidents to New York state regulators, including two ransomware attacks and a phishing incident that led to malware deployment and additional data theft. That history raises fair questions about whether this breach represents a systemic problem rather than a one-off failure.

Social engineering attacks — where an attacker manipulates a person rather than cracking software — are notoriously difficult to prevent entirely, but they are also a known vector that mature security programs actively train against. The fact that a single compromised employee account opened the door to nearly 6 million records is worth noting.

What You Should Do Right Now

Whether or not you receive a notification letter, if you’ve cruised with any Carnival Corporation brand in the past several years, these steps are worth taking:

Watch your email inbox for an official notification from Carnival Corporation.
Enroll in credit monitoring if offered — 24 months of free TransUnion monitoring is a meaningful benefit.
Review your credit reports at annualcreditreport.com for any unfamiliar accounts or inquiries.
Be alert to phishing attempts — your name, email, and date of birth in the wrong hands make for convincing scam messages.
Consider a credit freeze if you’re not planning to apply for credit in the near term. It’s free, reversible, and the most effective protection against new account fraud.

The good news, such as it is: no financial information or Social Security numbers appear to have been included in what was accessed. But loyalty program data, passport numbers, and dates of birth are still enough to cause real problems in the wrong hands.

We’ll be watching for any updates from Carnival as the investigation continues.

Source: Carnival confirms data breach impacting nearly 6 million — Malwarebytes