Carnival says a data breach affected nearly 6 million people: what the notice and state records show

What happened in the Carnival data breach?

Carnival says its IT security team found unauthorized activity on an employee's account on April 14, 2026, blocked it and started an investigation with outside security experts. On April 22, 2026 it first determined that personal information had been copied.

Date	What the letter and the regulators' records say
April 10, 2026	Breach date on the California, Washington and Indiana records
April 14, 2026	Carnival's IT security team identifies unauthorized activity on an employee's account
April 22, 2026	Carnival first determines that personal information was copied
May 27, 2026	Date printed on the letter; notice recorded by California and Washington; Indiana's report gives this as the date notice was sent
May 28, 2026	Report logged in Massachusetts; posted on the Texas attorney general's list
August 31, 2026	Last day to enroll in the TransUnion monitoring

The letter is dated 43 days after the activity was found. Carnival's quarterly report for the period ended May 31, 2026 refers to the event as a data security incident that occurred on April 14, 2026.

What information was involved?

The filed letter leaves the list of information as a blank field filled in for each person. The state records describe identity documents rather than financial or health data. Washington lists names, driver's license or state ID numbers, full dates of birth and passport numbers. Texas lists names, addresses, driver's license numbers, government-issued ID numbers such as passports, and dates of birth. Massachusetts marks driver's licenses as breached and Social Security numbers, medical records, financial accounts and payment cards as not breached.

Information type	Washington	Texas	Massachusetts
Name	Yes	Yes
Driver's license or state ID	Yes	Yes	Yes
Passport or other government ID	Yes	Yes
Date of birth	Yes	Yes
Address		Yes
Social Security number			No
Financial account or payment card			No

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	Total affected, as reported to Indiana	5,995,277
Indiana attorney general	Indiana residents	85,084
Texas attorney general	Texans	800,060
Washington attorney general	Washingtonians	54,960
Massachusetts consumer affairs office	Massachusetts residents	46,241

Carnival ranks in the top ten of the Washington ranking and fifth in the national ranking from Indiana's report. The federal health breach list does not apply: Carnival is not a health care organization.

What is Carnival offering people who got a letter?

Carnival offers a 24-month TransUnion credit monitoring membership at no cost.

Item	Detail from the letter
Provider	TransUnion
Length	24 months
Enrollment	www.mytrueidentity.com, with the activation code in the letter's attachment
Deadline	August 31, 2026 (the code stops working after that date)
Phone	1-844-593-8310, 8 a.m. to 8 p.m. ET, Monday to Friday, excluding major U.S. holidays

Carnival says it has strengthened its security and monitoring controls since the incident. Because passport and driver's license numbers are involved, the credit monitoring offers guide and the social engineering guide are useful context.

What the documents leave open

• What kind of social engineering was used, and what the employee's account could reach.
• Whether Carnival's passengers, employees or both are affected; the letter does not say whose data the files held.
• Why Indiana's total (5,995,277) is so much larger than the state counts.

How many people did the Carnival data breach affect?

Nearly 6 million. Carnival's report to Indiana's attorney general gives 5,995,277 people affected in total, 85,084 of them Indiana residents. The letter itself states no count, and the California record carries none.

Only four notices in Indiana's 2026 report give a larger total: DriveWealth with 30,000,000, DentaQuest with 29,000,000, Grant County Public Hospital District #2 (Quincy Valley Medical Center) with 9,540,683 and AssuranceAmerica with 6,998,886. The state counts in the table above are each state's own residents, which is why they are far smaller.

Did Carnival report the breach to the SEC?

Not in a current report. None of the six Form 8-Ks Carnival filed between April 1 and November 8, 2026 carries Item 1.05, the item for a material cybersecurity incident; they cover results, a shareholder vote, financing and other corporate matters. The event appears instead in Carnival's quarterly reports for the periods ended May 31, 2026 and August 31, 2026, filed on June 26 and September 29, which both describe it in the same words. Neither quarterly report gives a count of people affected or a cost for the incident.

Was my passport number exposed in the Carnival breach?

It may have been. Washington lists passport numbers and Texas lists government-issued ID numbers such as passports for this breach. Your own letter lists the items that apply to you.

Can I still sign up for Carnival's credit monitoring?

The letter's deadline was August 31, 2026, and it says the code will not work after that date.