Carnival Corporation Ltd.

Carnival Corporation based in Miami, Florida, a other entity reported a data breach to the Texas Attorney General. The breach was discovered on 2026-04-14 and reported on 2026-05-28. 800,060 Texas residents were affected. 5,995,277 individuals affected in total. Types of information involved: Name of individual;Address;Driver’s License number;Government-issued ID number (e.g. passport, state ID card);Date of Birth. Consumers were notified via Notice by publication in print media;Posted at company website or special website;Email.

Carnival Corporation notified Massachusetts residents of a cybersecurity event on May 27, 2026. On April 14, 2026, an unauthorized actor used social engineering/phishing to gain access to an employee account and copy personal information. The company blocked the activity, engaged third-party security experts, and is offering 24 months of complimentary TransUnion credit monitoring. The specific data elements are redacted in this template but include PII.

Carnival Corporation reported a data breach to the Vermont Attorney General. The breach was reported to the AGO on 2026-05-28. The reporting organization type is Hospitality. 3,915 Vermont residents were affected. Categories of data breached: Government ID Numbers.

Carnival Corporation notified South Carolina residents of a cybersecurity event on May 27, 2026. On April 14, 2026, unauthorized activity involving an employee's account was identified. An unauthorized actor used social engineering to gain access to a limited portion of the Company's IT system. The Company blocked the activity and engaged third-party security experts. Personal information was illegally copied starting April 22, 2026. The Company is offering 24 months of complimentary credit monitoring through TransUnion.

Carnival Corporation reported a cybersecurity event in Washington affecting 54,960 individuals. Unauthorized access occurred between April 10-14, 2026, via social engineering/phishing against an employee account. Personal information was copied. The company engaged third-party security experts and offered 24 months of credit monitoring.

Carnival Corporation notified Nebraska AG on May 27, 2026, of a cybersecurity event discovered on April 14, 2026. An unauthorized actor used social engineering (phishing) to gain access to an employee account and copied personal information. The company blocked the activity, engaged third-party security experts, and is offering 24 months of TransUnion credit monitoring to affected individuals.

Carnival Corporation reported a data breach occurring on April 10, 2026, discovered on April 14, 2026. The incident affected 5,995,277 individuals nationwide, including 9,746 Maine residents. Notification was sent electronically on May 27, 2026. Affected individuals were offered 24 months of credit monitoring and fraud assistance through TransUnion. The specific nature of the breach and data types were not detailed in the filing.

Carnival Corporation reported a data breach to the Indiana Attorney General. The breach occurred on 2026-04-10 and was reported on 2026-05-27. 85,084 Indiana residents were affected. 5,995,277 individuals affected in total.

Carnival Corporation reported a data breach to the Oregon Attorney General. The breach was reported on 2026-05-27. The breach occurred during 4/10/2026 - 4/14/2026. The breach was discovered on 4/14/2026. 5,995,277 individuals were affected. Notice was sent on 5/27/2026.

Carnival Corporation reported a cybersecurity event where an unauthorized actor used social engineering to deceive an employee and gain access to a limited portion of the company's IT system on April 14, 2026. The actor illegally copied personal information, which was determined on April 22, 2026. The company blocked the activity, engaged third-party security experts, and is offering 24 months of complimentary credit monitoring to affected individuals.

Carnival Corporation notified affected individuals of a cybersecurity event where an unauthorized actor used social engineering to gain access to an employee's account and illegally copied personal information. The incident was discovered on April 14, 2026, and the company offered 24 months of complimentary credit monitoring through TransUnion.

Carnival Corporation notified Iowa AG of a cybersecurity event where an unauthorized actor used vishing to obtain employee credentials on April 10, 2026. The actor exfiltrated personal information including names, addresses, DOBs, and government IDs. Discovery was April 14, 2026. Notifications began May 27, 2026, offering 24 months of credit monitoring.

Carnival Corporation notified New Hampshire AG of a cybersecurity event where an unauthorized actor used voice phishing (vishing) to obtain employee credentials and exfiltrate personal information of approximately 11,477 NH residents. The incident involved names, addresses, emails, phone numbers, DOB, and government IDs. Notifications began May 27, 2026, offering 24 months of credit monitoring.

CARNIVAL CORPORATION filed a data-breach notice with the Illinois Attorney General in May 2026 (case 26-05-1225). The register records the breach as discovered on April 14, 2026. Personal information types reported: drivers license, passport number. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Over 8.7M records containing PII and other terabytes of internal corporate data have been compromised. Pay or Leak. This is a final warning to reach out by 21 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 18 Apr 2026 | Warning: FINAL WARNING PAY OR LEAK

Carnival Corporation notified Delaware AG of unauthorized third-party access to IT systems detected on August 15, 2020. Access occurred in early August 2020, impacting guest, employee, and crew data including names, addresses, passport numbers, DOB, and potentially SSN/health info. Company engaged cybersecurity firm, notified law enforcement, and offers 12 months credit monitoring.

Carnival Corporation and plc submitted a data security breach notification to the California Office of the Attorney General on March 12, 2021. The incident involved unauthorized access to customer data, potentially exposing names, Social Security numbers, and financial account information. The company provided one year of free credit monitoring, cyber monitoring, and a $1,000,000 insurance reimbursement policy to affected individuals. The notification covers residents of multiple US states, including California, Iowa, and Kentucky.

Supplemental notice from Carnival Corporation to the New Hampshire Attorney General regarding a data security event. The company is notifying 79 New Hampshire residents of unauthorized access to their personal information. Initial notices were sent in May and June 2021.

Carnival Corporation and plc reported a data breach to the Oregon Attorney General. The breach was reported on 2021-10-18. The breach occurred during 3/12/2021. The breach was discovered on 3/19/2021. 20,992 individuals were affected. Notice was sent on 5/21/2021.

Carnival Corporation and plc reported a data breach impacting 94 Maine residents, which was discovered on March 19, 2021. The incident, which occurred on March 12, 2021, was described as an external system breach or hacking. The company provided written notification to affected individuals on May 21, 2021, and offered one year of complimentary credit monitoring services.

Carnival Corporation notified Montana residents of a data breach detected on March 19, 2021, involving unauthorized access to email accounts. The incident impacted guest, employee, and crew personal information including names, addresses, passport numbers, DOBs, health info, and SSNs. The company engaged a cybersecurity firm, notified regulators, and offered one year of credit monitoring.

Carnival Corporation and Plc reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2021-07-27. 411 Massachusetts residents were affected. The report records the breach type as electronic.

Carnival Corporation notified the New Hampshire Attorney General of a data security event detected on March 19, 2021. Unauthorized third-party access affected 69 New Hampshire residents, exposing names, addresses, passport numbers, dates of birth, health information, and potentially SSNs. The company engaged forensic experts, shut down access, and began notifying residents on May 21, 2021, offering one year of credit monitoring.

Carnival Corporation and pic reported a data breach to the Indiana Attorney General. The breach occurred on 2021-03-12 and was reported on 2021-05-21. 243 Indiana residents were affected. 20,992 individuals affected in total.