F500 Travel & Leisure · Travel & Leisure · Regulatory action + Data breach
Royal Caribbean Cruises
Headline
The February 2021 breach was disclosed through a state attorney general filing (California, June 2021), which is again the mechanism by which most of these surface.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The February 2021 breach was disclosed through a state attorney general filing (California, June 2021), which is again the mechanism by which most of these surface. Cruise data is unusually complete: a booking includes passport details, dates of birth, payment information, cabin occupancy, onboard purchases, shore excursions and, increasingly, wearable tracking devices that locate passengers throughout the ship. A cruise line knows where a passenger was at essentially every moment of a week-long trip.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
HISTORICAL BREACH (Feb 2021, reported to the California AG on June 23, 2021): Royal Caribbean Cruises Ltd. notified a breach dated Feb 6, 2021, reportedly involving unauthorized access to employee email accounts containing guest personal information — part of the same general cruise-industry vendor/email-security risk pattern documented for Carnival (this same tab). No more recent (2025-2026) Royal Caribbean-specific incident independently confirmed this pass, though the broader ShinyHunters/Scattered Spider campaign affecting Carnival may plausibly extend to other cruise lines given shared industry vendors.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy royalcaribbean.com/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service royalcaribbean.com/terms-and-conditions | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.