F500 Travel & Leisure · Travel & Leisure · Regulatory action + Data breach
Carnival
Headline
Repeated incidents across seven years - a 2019 employee-email compromise, an August 2020 ransomware attack disclosed in an SEC 8-K, and the April 2026 social-engineering breach - and repetition through distinct…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Repeated incidents across seven years - a 2019 employee-email compromise, an August 2020 ransomware attack disclosed in an SEC 8-K, and the April 2026 social-engineering breach - and repetition through distinct incidents is the finding rather than any single one. Carnival is the largest cruise operator in the world and runs numerous brands - Princess, Holland America, Cunard and others - under one parent, so a passenger choosing between them is choosing a ship, not a data controller. Carnival's regulatory history also includes significant environmental compliance matters, which is a different category and should not be blended with the data findings.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected for individual cruise-passenger agreements.
Data sharing
AT LEAST THREE SEPARATE INCIDENTS ACROSS 7 YEARS (the two below plus an August 2020 ransomware attack disclosed in an 8-K filed Aug 17 2020): (1) A 2019 breach (publicly reported March 2020) exposed 180,000 Carnival employees'/customers' information (names, addresses, passport numbers, driver's license numbers, payment card data, health information, and some SSNs) via unauthorized access to employee email accounts — Carnival first noticed suspicious activity in May 2019 but did not report the breach for approximately 10 MONTHS; a COALITION OF 46 ATTORNEYS GENERAL (45 states plus D.C.) secured a $1.25 million multistate settlement (2022), with regulators specifically citing Carnival's 'reckless data security practices.' (2) A NEW, SEPARATE, MUCH LARGER breach (April 2026): the ShinyHunters group claimed to have stolen over 8.7 MILLION records (Carnival has not attributed the attack or confirmed that figure). Per Carnival's notice, an unauthorized actor used social engineering to deceive an employee; Carnival identified the activity April 14 2026, its Maine AG filing reports 5,995,277 people affected, notices began about May 27 2026, and eligible U.S. residents were offered two years of TransUnion credit monitoring. Class actions were reportedly filed afterward; case names and court were NOT verified this pass.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (CCL). Service route: c/o General Counsel / Corporate Secretary, Miami, Florida — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy carnival.com/about-carnival/privacy-notice | Not fetched yet | NO (HTML only) |
| Terms of service carnival.com/about-carnival/legal-notice | Not fetched yet | NO (HTML only) |
| Website carnival.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: Florida. Provisions of FDBR on file:
| Provision | Type | Source |
|---|---|---|
| Applicability — Narrowest of Any State; $1B Revenue + Specific Activities Fla. Stat. § 501.702 | threshold | source |
| Enforcement — Highest Per-Violation Penalties; Trebled for Minor Violations Fla. Stat. § 501.72 | hard | source |