Carnival data breach: what happened and what to do

What happened

Have I Been Pwned (HIBP) dates the Carnival breach to 18 April 2026 and added it to its database on 24 April 2026. It lists 7,531,359 accounts. Carnival's own notice says its IT security team detected unauthorized activity involving an employee's account in April, and that someone had used social engineering, meaning they tricked an employee, to get into a limited part of the company's systems.

Carnival began notifying customers on 27 May 2026. A breach notice the company filed with Maine's attorney general counts 5,995,277 people affected. That figure counts people, while HIBP counts unique accounts, so the two numbers don't match. A group called ShinyHunters publicly claimed the theft and the leak of millions of records, according to news coverage.

What was exposed

HIBP lists these data types: names, email addresses, dates of birth, genders, geographic locations, salutations (Mr, Ms and so on) and loyalty program details. HIBP does not list passwords, and the company's notice describes the intrusion as limited. Some news outlets reported government ID numbers such as passport or driver's license numbers. Neither HIBP nor the company filing quoted in coverage lists them, so treat that as unconfirmed.

What criminals can do with it

A full name, an email address and a date of birth are the core of a convincing scam message. Add the fact that you are a loyalty member of a cruise line, and a criminal can write an email that looks like a booking confirmation, a loyalty status update or a refund notice. Those messages usually push you toward a fake login page. Dates of birth also matter beyond this one account: they are a common identity check at banks and phone carriers, and unlike a password you can't change yours.

Loyalty details can feed travel scams in particular. Expect messages about upgrades, onboard credit or a cancelled sailing, often with a deadline that pushes you to click before thinking.

Carnival's response

Carnival is offering eligible U.S. residents two years of complimentary credit monitoring through TransUnion, with enrollment open until 31 August 2026. The company also set up a call center for questions about the incident and the monitoring offer. Notices were sent by email and mail to the people the company identified.

If you sailed with Carnival

You may be in this breach even if you never created a loyalty account. Check the email address you used for bookings, any older addresses you used years ago, and the address on any family members' bookings you paid for. If the HIBP check shows your email, assume the details listed above are in criminal hands and act on the steps below.

You don't need to panic. No payment cards or passwords are listed, so the realistic near-term risk is targeted phishing and, over time, attempts to use your date of birth and name to open accounts or reset passwords elsewhere. The steps below take about 15 minutes in total.