Carnival Cruise Line Data Breach Exposes Personal Information of Nearly 6 Million
Carnival Cruise Line has disclosed a significant data breach affecting nearly 6 million individuals, with compromised information including names, addresses, dates of birth, driver’s license numbers, and passport numbers. The breach occurred in April when hackers used a social engineering attack to deceive an employee and gain access to a limited portion of the company’s IT systems.
In response, Carnival has implemented additional security measures and is offering two years of free credit monitoring through TransUnion to those impacted. The incident underscores the growing threat of social engineering in cyberattacks, particularly in sectors handling sensitive customer data. Federal authorities are continuing their investigation into the breach.
Source: https://nbcmontana.com/news/local/carnival-warns-nearly-6-million-people-of-potential-data-breach
Carnival Cruise Line cybersecurity rating report: https://www.rankiteo.com/company/carnival-cruise-line
"id": "CAR1780325760",
"linkid": "carnival-cruise-line",
"type": "Breach",
"date": "4/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Nearly 6 million',
'industry': 'Travel and Hospitality',
'name': 'Carnival Cruise Line',
'type': 'Corporation'}],
'attack_vector': 'Social Engineering',
'customer_advisories': 'Two years of free credit monitoring through '
'TransUnion',
'data_breach': {'number_of_records_exposed': 'Nearly 6 million',
'personally_identifiable_information': 'Names, addresses, '
'dates of birth, '
'driver’s license '
'numbers, passport '
'numbers',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Personal Information'},
'date_detected': '2024-04',
'description': 'Carnival Cruise Line has disclosed a significant data breach '
'affecting nearly 6 million individuals, with compromised '
'information including names, addresses, dates of birth, '
'driver’s license numbers, and passport numbers. The breach '
'occurred in April when hackers used a social engineering '
'attack to deceive an employee and gain access to a limited '
'portion of the company’s IT systems.',
'impact': {'data_compromised': 'Names, addresses, dates of birth, driver’s '
'license numbers, passport numbers',
'identity_theft_risk': 'High',
'systems_affected': 'Limited portion of IT systems'},
'initial_access_broker': {'entry_point': 'Employee deception via social '
'engineering'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Growing threat of social engineering in cyberattacks, '
'particularly in sectors handling sensitive customer data',
'post_incident_analysis': {'corrective_actions': 'Additional security '
'measures implemented',
'root_causes': 'Social engineering attack on '
'employee'},
'references': [{'source': 'Carnival Cruise Line Disclosure'}],
'response': {'law_enforcement_notified': 'Federal authorities',
'remediation_measures': 'Additional security measures '
'implemented',
'third_party_assistance': 'TransUnion (credit monitoring)'},
'title': 'Carnival Cruise Line Data Breach Exposes Personal Information of '
'Nearly 6 Million',
'type': 'Data Breach'}