Carnival Data Breach Lawsuit Over the April 2026 Cyberattack

Carnival cruise customers may have had their personal information swept up in a significant data breach, according to a lawsuit now making its way through federal court. The suit alleges that in April 2026, hackers broke into Carnival's computer systems and stole millions of records containing customer data.

Carnival says the breach began when attackers deceived an employee into granting system access, and that its security team detected the suspicious activity on April 14, 2026. The hacking group ShinyHunters reportedly claimed responsibility for taking more than 8.7 million records, with an estimated 6 million people affected.

The information exposed may include names, dates of birth, contact information, and other identifying details. According to the lawsuit, this leaves affected customers at continued risk of identity theft, fraud, and unauthorized accounts opened in their names.

Plaintiffs allege Carnival failed to maintain reasonable data security despite profiting from collecting customer information, and that the company was too slow to notify people after discovering the breach. The complaint raises claims of negligence, breach of implied contract, invasion of privacy, and unjust enrichment, all allegations that Carnival has not been found liable for in court.

The lawsuit seeks monetary damages, lifetime credit monitoring for everyone impacted, and a court order forcing Carnival to strengthen its cybersecurity practices.

Eight similar lawsuits against Carnival were consolidated into a single case in May 2026, with attorneys appointed to represent the proposed class. Plaintiffs filed a joint complaint on June 22, 2026.

The case has since shifted direction: on August 14, 2026, Carnival and the plaintiffs jointly requested a pause in litigation so they could pursue mediation, and the judge granted it. Mediation is a confidential process where both sides negotiate with a neutral third party, it doesn't guarantee a resolution, and no settlement has been reached or announced.

There's currently no claim form to fill out, and no action is needed right now. If a settlement is eventually reached and approved by the court, affected individuals would typically receive official notice with instructions on how to file a claim.