Now Hacked
EN-GB
Data breach

Carnival staff account takeover exposes data of around 5.99 million people

First reported · Last reported · 45 related reports

A social engineering attack targeting employee accounts at cruise operator Carnival led to the leak of personal data of around 5.99 million travellers. Carnival disclosed the data breach in May 2026. A class action was filed over delays in notifying customers, and Texas authorities opened an investigation into the incident, which affected more than 800,000 residents.

Key facts

Affected organisation
Carnival
Incident type
Data breach
Occurred / detected
Not confirmed
Scale of damage
Personal data of around 5.99 million people
Cause / method
Employee account takeover via social engineering attack
Location
United States

If your data was exposed

  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.

Timeline

  1. Carnival investigated a suspected data breach.
  2. A class action was filed alleging that Carnival had failed to notify customers of the data breach.
  3. Carnival disclosed the data breach.
  4. It came to light that personal data of around 5.99 million people had been leaked through an employee account takeover.
  5. Texas authorities opened an investigation into the data breach affecting more than 800,000 residents.

Also affected by this incident

45 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.