Carnival Corporation, the world’s largest cruise company, has revealed a significant data breach impacting nearly 6 million customers. The company is offering two years of complimentary credit monitoring to affected U.S. travelers as a precautionary measure.

Details of the Breach

In April, Carnival identified unauthorized access to a portion of its IT system. This breach was the result of a social engineering attack on a single user account, allowing an unauthorized actor to gain access to sensitive information. The company quickly blocked the activity, engaged third-party security experts, and notified law enforcement.

The breach, as reported to the Maine Attorney General’s office, affected 5,995,277 individuals. Carnival’s 2025 annual report indicates that the company served approximately 13.5 million guests that year across its fleet of 90 ships, which includes popular lines such as AIDA, Costa, Cunard, Holland America, P&O, and Princess.

Compromised Information

Carnival’s ongoing investigation has determined that the compromised data includes names, email addresses, phone numbers, dates of birth, and driver’s license and passport numbers. Notification letters have been sent to those affected, and an online notice was published for individuals who could not be reached directly.

The company has faced criticism for the time taken to notify customers. In response, Carnival explained that complex incidents require thorough investigation to accurately determine the scope of the breach and ensure proper notification. The company has since enhanced its security measures to prevent future incidents.

Customer Reactions

Some customers expressed frustration on online forums, with suggestions ranging from compensation to future cruise vouchers. There are unverified reports that Carnival refused to pay a ransom, leading to the publication of customer information on the dark web, though the company has not confirmed these claims.

Securityweek.com reported that the extortion group ShinyHunters claimed responsibility for the attack, but Carnival has not verified this assertion.

Protective Measures

Carnival is encouraging affected customers to enroll in the provided credit monitoring service and to remain vigilant by monitoring their accounts and credit histories. The company advises contacting local law enforcement if fraud or identity theft is suspected.

Original reporting: Fox News (HLL/CB) — read the source article.