Carnival Corporation has confirmed a data breach affecting nearly six million customers, with the incident occurring in April after a hacker used social engineering to access a limited part of its IT system. The company disclosed the breach in a regulatory filing with the Maine Attorney General's office, stating that the personal data of 5,995,277 people was exposed.
The cruise operator, which runs 90 vessels under brands including Princess, Holland America, Cunard and Carnival Cruise Line, served approximately 13.5 million passengers in 2025. Compromised information includes names, addresses, email addresses, phone numbers, birth dates and government-issued identification numbers such as driver's licence and passport numbers.
Carnival said it immediately blocked the activity, engaged third-party security experts and alerted law enforcement after detecting the unauthorised access. The company began sending individual email notifications on May 27 and launched a public webpage to reach those with missing or outdated contact details.
In response to the breach, Carnival is offering two years of complimentary credit monitoring through TransUnion for affected U.S. customers. The company urged individuals to remain vigilant against identity theft or fraud by regularly reviewing account statements and credit histories, and to contact local police if they suspect fraudulent activity.
Security Week reported that the extortion collective ShinyHunters has claimed responsibility for the breach, though Carnival has not publicly verified this claim or disclosed whether a ransom demand was made. Carnival stated it had taken steps to further safeguard its systems, including enhancing security and monitoring controls, and would continue to advance its defences.
