By Katherine Hamilton
Carnival was hit with a cybersecurity attack in April that led to the exposure of some individuals' data and personal information.
An unauthorized actor used social engineering to deceive an employee to gain access to a limited portion of Carnival's information technology system, the cruise line said Wednesday.
The company's cybersecurity team identified the issue on April 14 and blocked the activity. It immediately began working with third-party security experts to strengthen security and conduct an investigation, the company said.
Carnival determined that the bad actor illegally accessed certain personal information. The company said it has notified all individuals whose data was impacted. It also launched a webpage to report the incident publicly.
Carnival is still working to determine exactly what information was accessed, but it does know that the information included names, addresses, email addresses, phone numbers, birth dates and government-issued identification numbers, such as driver's license and passport numbers.
The impacted data varies by individual, Carnival said.
Carnival is offering impacted individuals in the U.S. two years of complimentary credit monitoring through TransUnion.
Write to Katherine Hamilton at katherine.hamilton@wsj.com
(END) Dow Jones Newswires
May 27, 2026 16:46 ET (20:46 GMT)
Copyright (c) 2026 Dow Jones & Company, Inc.