Carnival confirms personal-data exfiltration following employee vishing

Resumen

Suspicious activity was detected on April 14 and copying confirmed on April 22. Fields varied by person and included names, addresses, email, phone, birth dates and government ID numbers such as passports or driving licences. The official notices do not state an overall total.

Cronología

1. 2026-04-10Ocurrencia
2. 2026-04-14Descubrimiento
3. 2026-05-27Divulgación
4. 2026-04-10

   A call impersonating internal IT obtained credentials.

5. 2026-04-14

   Unauthorized activity detected.

6. 2026-04-22

   Personal-data copying confirmed.

7. 2026-05-27

   First public notice and individual notifications.

Respuesta de la organización

Carnival blocked access, investigated with specialists and notified law enforcement. Notices began May 27 and eligible US individuals were offered 24 months of protection services.

Fuentes

1. Carnival Corporation Notice of Data BreachCarnival Corporation / PR Newswire · 2026-11-09
2. Carnival regulator letter and sample individual noticeIowa Attorney General / Carnival · 2026-11-09