Carnival confirms personal-data exfiltration following employee vishing

Überblick

Suspicious activity was detected on April 14 and copying confirmed on April 22. Fields varied by person and included names, addresses, email, phone, birth dates and government ID numbers such as passports or driving licences. The official notices do not state an overall total.

Zeitlicher Ablauf

1. 2026-04-10Vorfall
2. 2026-04-14Entdeckt
3. 2026-05-27Bekanntgegeben
4. 2026-04-10

   A call impersonating internal IT obtained credentials.

5. 2026-04-14

   Unauthorized activity detected.

6. 2026-04-22

   Personal-data copying confirmed.

7. 2026-05-27

   First public notice and individual notifications.

Reaktion der Organisation

Carnival blocked access, investigated with specialists and notified law enforcement. Notices began May 27 and eligible US individuals were offered 24 months of protection services.

Quellen

1. Carnival Corporation Notice of Data BreachCarnival Corporation / PR Newswire · 2026-11-09
2. Carnival regulator letter and sample individual noticeIowa Attorney General / Carnival · 2026-11-09