Carnival Corporation (Holland America Line) data breach
Was I affected?
Carnival Corporation (Holland America Line) confirmed a breach affecting about 6 million people, exposing names, email addresses and dates of birth. You may be affected if you sailed with Holland America Line or are a Mariner Society member and received a Carnival/Holland America notice from late May 2026.
| Announced | Apr 24, 2026 |
|---|---|
| When it happened | April 14, 2026 |
| People affected | 6 million |
| Data exposed | Names, Email addresses, Dates of birth and Other details |
| Status | Confirmed by the company or a regulator filing |
What happened
Carnival Corporation said a phishing attack on a single employee account in April 2026 exposed data from Holland America Line's Mariner Society loyalty program, which ShinyHunters then leaked. Carnival told Maine regulators that 5,995,277 people were affected; data included names, birth dates, gender, email addresses and loyalty status. It began notifying people on May 27, 2026 and offered two years of credit monitoring to US residents.
What should I do?
- Treat emails, texts and calls that mention Holland America, Mariner Society points or cruise credits as suspect; don't click links or share codes, and contact the company through its official app or website.
- Enroll in the two years of TransUnion credit monitoring offered to US residents.
- Change your Holland America password and any other account that uses the same password, and turn on two-step verification.
Check whether your email address is in this breach on Have I Been Pwned (breach data from haveibeenpwned.com, CC BY 4.0).
Check the other services you use →
Sources
- Cybercriminals sail away with data from 6 million Carnival customers · Help Net Security (news)
- ShinyHunters claim cruise giant Carnival's data · The Register (news)