Carnival Cruise Data Breach Lawsuit: April 2026 Breach, Who Qualifies, Case Status

Carnival Corporation runs Carnival Cruise Line and other cruise brands. In a notice dated May 27, 2026, Carnival said its IT security team identified unauthorized activity involving an employee's account on April 14, 2026. According to Carnival, "an unauthorized actor used social engineering to deceive an employee" and, on April 22, 2026, the company first determined the actor had copied personal information.

Carnival's notice says the data varies by person but is known to include:

• Name, address, email address, and phone number
• Date of birth
• Government-issued ID numbers, such as driver's license and passport numbers

Security reporters said the extortion group ShinyHunters claimed the attack, and some reports list extra fields such as gender and Mariner Society loyalty tier. A few secondary reports mention payment or health data, but Carnival's notice does not, so treat those as unconfirmed. Passport and license numbers are the most serious items here because they can help criminals open accounts or pass identity checks.

Carnival said it began sending individual notices on May 27, 2026 and offers people in the U.S. two years of free credit monitoring through TransUnion. Its filing with the Maine Attorney General put the total at 5,995,277 people. This is a data breach caused by social engineering, which is a phone or message trick aimed at an employee rather than a software hack.

At least seven proposed class actions were filed in the U.S. District Court for the Southern District of Florida between April 22 and April 24, 2026, before Carnival had even mailed notices. They include Stavropoulos, Pottle, Cole, Brookner, Collins, and Vasquez v. Carnival Corporation.

On May 8, 2026, Judge Rodolfo A. Ruiz II granted a motion to consolidate the cases and appoint interim class counsel, and ordered all filings to go under Case No. 1:26-cv-22793. A consolidated amended complaint was filed June 22, 2026. The docket then shows a motion to stay and an order on that motion on August 14, 2026. The public docket entries we reviewed do not say why a stay was sought. In data breach cases a stay often signals mediation or settlement talks, but that is not confirmed here, and you should not assume a settlement is coming.

Government regulators are also looking at the breach. Texas Attorney General Ken Paxton announced an investigation and issued a civil investigative demand to Carnival, citing about 800,000 affected Texans. That inquiry is separate from the class action and would not pay individuals directly.

No class has been certified, no ruling on the merits has been made, and Carnival has not admitted wrongdoing. The allegations are unproven. Our guide on checking a case's status explains how to follow a docket yourself.

The consolidated complaint seeks to represent people whose personal information was exposed in the April 2026 breach. In practice that means:

• Anyone who received Carnival's Notice of Data Breach, by email or by letter, starting May 27, 2026.
• Past and current guests and loyalty members whose records were in the affected system.
• Employees or others whose information Carnival held in the same system.

Carnival also posted a substitute notice on its website for people it could not reach by email or had out-of-date contact information for. If you sailed with Carnival but did not get a notice, call the TransUnion call center listed in that notice to ask whether your data was included.

You probably do not qualify if you never booked with or worked for Carnival, or if Carnival confirms your data was not involved. Having your data exposed is not the same as having a large claim. Settlements usually pay more to people who can show identity theft, fraud, or real costs.

Cruise ticket contracts commonly include dispute terms that limit where and how passengers can sue. Those terms were written mainly for injuries at sea, and courts decide case by case whether they reach data breach claims. The consolidated case was filed in Miami, where Carnival is based, which avoids one common fight over where passengers must sue.

There is no Carnival settlement, so there is no payment amount yet. Data breach settlements usually include some mix of:

Benefit	Typical proof
Reimbursed out-of-pocket losses	Receipts and statements
Payment for lost time	A short sworn statement
Extra payment for ID theft	Police or FTC report
Flat cash payment	Valid claim only
Credit monitoring	Valid claim only

Government ID numbers raise the stakes compared with breaches that only exposed emails, which can push settlement values up. On the other hand, a class of about 6 million people means a fixed fund gets split many ways. For real figures from past cases, see our guide on how much a data breach settlement is worth.

California residents may have a CCPA claim. The California Consumer Privacy Act allows statutory damages of $100 to $750 per consumer per incident when certain nonencrypted personal information, including passport and driver's license numbers, is stolen because of unreasonable security. Nothing here means you will receive money.

The Carnival breach is more serious than many because it included government ID numbers for some people. Here is what that means in practice:

• Driver's license numbers can be used to open accounts, pass identity checks, or create fake IDs. Some state motor vehicle agencies let you report misuse or flag your record. Check your state DMV's fraud page if you see signs of misuse.
• Passport numbers are used in travel bookings and some identity checks. A passport number by itself is less useful to criminals than a stolen physical passport, but combined with your name, address, and date of birth it can support impersonation.
• Dates of birth plus addresses are the building blocks of new-account fraud, which is why a credit freeze matters most.

The IRS offers an Identity Protection PIN to any taxpayer who wants one, which blocks someone else from filing a tax return using your Social Security number. Carnival's notice does not list Social Security numbers for this breach, but people whose other data was exposed often add this protection as well.

Keep a simple log: the date you enrolled in monitoring, when you froze your credit, and any suspicious activity. If a settlement later offers payment for time spent or for documented losses, that log is what you will need. Report any identity theft at the FTC's IdentityTheft.gov, which creates a recovery plan and a report you can use with banks and credit bureaus.

Finally, be careful with messages about your cruises. The exposed data includes contact details and, for some people, loyalty program information, which scammers can use to send convincing fake booking changes, refund offers, or "security verification" requests. Log in to your Carnival account directly or call the number on Carnival's official website instead of using links in unexpected messages. Carnival's notice says the dedicated TransUnion call center can answer questions about the incident.

This is not Carnival's first security failure, and that history is likely to feature in the case.

• 2019 email breach. In March 2020, Carnival reported that an unauthorized actor had accessed employee email accounts, exposing data on about 180,000 employees and customers, including passport and driver's license numbers, payment card information, health information, and some Social Security numbers. Notices said Carnival first noticed suspicious email activity in late May 2019, about 10 months before it reported the breach.
• Multistate settlement. On June 22, 2022, Carnival agreed to pay $1.25 million to 46 states and to adopt security measures, including an incident response and breach notification plan and a comprehensive security program.
• New York DFS penalty. On June 24, 2022, New York's Department of Financial Services announced a $5 million penalty over four cybersecurity events from 2019 to 2021, including two ransomware attacks. DFS found Carnival failed to implement multi-factor authentication, delayed reporting, and did not train staff adequately.

The 2026 breach also began with an employee being tricked. Plaintiffs are likely to argue that Carnival was on notice of this exact weakness. Those earlier settlements paid the states, not affected people.

Data breach complaints like these usually plead:

1. Negligence: failure to use reasonable security, such as training staff to resist social engineering and limiting what one employee account can reach.
2. Breach of implied contract and unjust enrichment: guests paid Carnival and gave their data expecting it to be protected.
3. State consumer protection and breach notice laws, including the CCPA for California residents and Florida's consumer protection statute, since Carnival is based in Miami.

Carnival found the intrusion on April 14, 2026 but did not begin individual notices until May 27, 2026, 43 days later, a gap the plaintiffs are expected to press.

There is no claim deadline because there is no settlement. Staying in the proposed class is automatic, and the pending class action generally pauses the statute of limitations for class members. The credit monitoring offer in your notice has its own enrollment deadline, so check the letter.

1. Enroll in the free TransUnion monitoring using the code in your notice.
2. Freeze your credit at Equifax, Experian, and TransUnion.
3. Protect your ID numbers. If your passport number was exposed, watch for identity misuse and consider asking the State Department about a replacement if you see fraud. Tell your state DMV if your license number is misused.
4. Beware of cruise and refund scams that use your real booking details. See our guide to settlement scams.
5. Keep records of costs, fraud, and time spent.

Our full checklist on what to do after a data breach notice covers each step. If you had identity theft or real losses, independent attorneys who handle data breach cases can review your options. A free case review takes about two minutes. For how these cases usually unfold, see our data breach lawsuit overview.