A security breach at Carnival Corporation has potentially compromised the personal information of nearly 6 million customers. The company, which operates numerous cruise lines including Carnival Cruise Line and P&O, reported the incident following unauthorized access to its IT system, which was achieved through a social engineering attack.
The data affected includes names, email addresses, phone numbers, dates of birth, and identification numbers such as driver's licenses and passports. In response, Carnival is offering two years of free credit monitoring to impacted U.S. travelers and has already begun notifying those affected by the breach.
Carnival's investigation, which involves external security experts, aims to clarify the extent of the data compromised. The company served approximately 13.5 million guests in 2025. It has expressed regret over the incident, emphasizing its commitment to protecting customer privacy and security.