Hackers Took 6 Million Carnival Guest Records. Carnival Told Investors the Lawsuits 'Will Not Have a Material Impact.'

This is not the Carnival breach you may remember from 2019 — it is a new incident, and it started with social engineering, not malware. Per Carnival's official notice, an unauthorized actor deceived an employee to gain access to a portion of the company's systems. Carnival's filing with the Maine Attorney General dates the intrusion to April 10, 2026; the IT security team identified the unauthorized activity on April 14; and on April 22 the company confirmed personal information had been copied.

Public pressure arrived faster than the letters. The extortion group ShinyHunters listed Carnival on its leak portal on April 18 and, after its deadline passed, published what it claims are 8.7 million records with 7.5 million unique email addresses — much of it tied to Holland America's Mariner Society loyalty program. Carnival's own confirmed count, filed with state regulators: 5,995,277 people. Formal notification letters did not start until May 27, 2026.

Carnival's official notice lists: name, address, email address, phone number, date of birth, and government-issued ID numbers — including driver's license and passport numbers, with the affected data varying by individual. Notably absent from that official list: Social Security numbers, payment cards, and health information.

Some state-level reporting and plaintiffs' complaints allege broader categories, including SSNs. Those claims are unconfirmed by Carnival's own public notice — worth knowing if you receive a letter, because the monitoring you need depends on what was actually exposed for you. The state filings that are public show the scale: 800,060 Texans (whose Attorney General has opened an investigation and issued a civil investigative demand), 9,746 Maine residents, 3,915 Vermonters with government-ID numbers exposed.

The first class action — Pottle v. Carnival Corp., S.D. Fla. No. 1:26-cv-22801 — was filed April 22, 2026, five weeks before Carnival mailed its first notification letter; plaintiffs read the leak-site news like everyone else. Vasquez (1:26-cv-22866) and Cole (1:26-cv-22844) followed within days, alleging negligence, breach of implied contract, invasion of privacy, and unjust enrichment.

Carnival's quarterly SEC filing, submitted June 26, 2026, compresses all of it into two sentences: six purported class actions were brought in the Southern District of Florida over the April 14 incident, the court consolidated them in May — and, in the filing's words, "We believe the outcome of this matter will not have a material impact on our consolidated financial statements." A company with over $25 billion in annual revenue may well be right about materiality. Whether six million affected guests read it the same way is a different question. A separate proposed class action was filed for Canadian residents in British Columbia on June 17.

No settlement exists. No claims portal, no administrator, no filing deadline — the litigation is barely three months old, and data-breach class actions of this size typically take one to three years to reach a settlement, if they settle at all. Any website advertising a "Carnival breach claim form" today is generating leads or worse.

What actually exists for affected guests: two years of complimentary credit monitoring through TransUnion, offered in the official notices, with a dedicated call center at 1-844-593-8310 (8 a.m.–8 p.m. ET, weekdays). If you cruised with Carnival brands or joined Holland America's loyalty program, enrolling costs nothing and is worth doing — passport and license numbers do not expire the way payment cards do.

One last distinction, because aggregator sites blur it: the $1.25 million multistate settlement (46 states, 2022) and the $5 million New York DFS penalty resolved Carnival's 2019–2021 incidents affecting about 180,000 people. Those cases are closed. For the 2026 breach, the meter is still running.