Texas Probes Carnival Breach
Texas AG Ken Paxton Launches Probe into Carnival Data Breach Affecting 800,000 Texans
Key Points
800,060 Texas consumers were affected by the Carnival breach, according to the Texas AG's office.
In addition to Carnival Cruise Line, Princess Cruises and Holland America Line, Carnival's brands include P&O Cruises, Seabourn, Costa Cruises and AIDA Cruises, expanding the scope of the data held.
The breach was detected on April 14, 2026, when unauthorized activity involving an employee account was identified through social engineering.
Carnival’s privacy policy notes it may collect device content such as photos and contact lists with customer permission.
Carnival did not immediately respond to requests for comment about the breach and investigation, per the Houston Chronicle coverage.
Texas Attorney General Ken Paxton has launched an investigation into Carnival Corporation after a data breach exposed personal information for roughly 6 million people worldwide — including 800,060 Texans. Houston Chronicle reported that Carnival did not immediately respond to requests for comment.
The breach began on April 14, 2026, when a hacker used social engineering — a tactic where criminals trick employees into giving up access — to break into a single employee account. Carnival waited 44 days before notifying Texas, a potential violation of state law requiring notification within 30 days, according to Yahoo News.
Hackers Stole Passport, Payment, and Health Data
The unauthorized actor copied names, dates of birth, passport numbers, payment data, and health information from Carnival's systems. Investing.com reported that Carnival officially confirmed the data had been illegally copied on April 22 — eight days after the breach was first detected.
The cybercriminal group ShinyHunters claimed responsibility. The group says it grabbed 8.7 million records and tried to extort Carnival before leaking the data publicly, according to Have I Been Pwned, which added the breach to its database on April 24. That number is larger than the roughly 6 million Carnival has publicly acknowledged.
Carnival's 44-Day Delay Is a Central Focus of the Probe
Texas law requires companies to report breaches affecting more than 250 residents to the AG's office as soon as possible — and no later than 30 days after discovery. Carnival notified the state on May 27, 44 days after first spotting the breach. That gap is a key focus of the Civil Investigative Demand Paxton's office issued to the company, per WFAA.
Paxton said in a statement: "I am investigating the Carnival cruise line data breach to ensure that the company is held accountable for any illegal action and that Texans' private information is properly secured. Data breaches are a serious matter." If found in violation, Carnival could face fines of up to $50,000 per violation under the Texas Identity Theft Enforcement and Protection Act.
Carnival Offered Credit Monitoring but Raised More Questions
Carnival is offering two years of free credit monitoring through TransUnion to affected U.S. customers. The company said it enhanced its security and monitoring controls after the breach. But cybersecurity firm Malwarebytes flagged a troubling detail: Carnival's notification letters contained placeholder text reading "your <<data elements>> were obtained," suggesting the company struggled to identify exactly what was stolen for each person.
The breach spans all major Carnival brands — Carnival Cruise Line, Princess Cruises, Holland America Line, P&O Cruises, Seabourn, Costa Cruises, and AIDA Cruises. Passengers who used Holland America's "Mariner Society" loyalty program before April 18, 2026, are considered especially at risk for identity theft, according to Have I Been Pwned.
A Pattern of Security Failures Now Draws Multi-State Scrutiny
This is not Carnival's first breach. Between 2019 and 2021, the company reported four separate cybersecurity incidents — including two ransomware attacks and a phishing incident. Malwarebytes described the company's history as a "worrying track record" of vulnerabilities. Carnival's stock dropped about 1.1% on the day Paxton announced the probe, per Investing.com.
The legal pressure may grow beyond Texas. Law firm Labaton Keller Sucharow is already examining potential claims under the California Consumer Privacy Act and other state laws, according to Yahoo News. A multi-state legal fight looks increasingly likely as more details emerge from the investigation.
Sentiment
Mostly NegativePublishers
10
Articles
19
Reach
29
