Teollimi

Norwegian Cruise Line data breach

Was I affected?

Norwegian Cruise Line confirmed a breach affecting an undisclosed number of people, exposing names, email addresses and dates of birth. You may be affected if you have or had an upcoming Norwegian Cruise Line booking in autumn 2026, especially if you received an email quoting your booking number that asked you to verify a card.

Norwegian Cruise Line breach facts
AnnouncedNov 4, 2026
When it happenedScam emails noticed October 10, 2026
CountrySeveral countries
Data exposedNames, Email addresses, Dates of birth and Other details
StatusConfirmed by the company or a regulator filing

What happened

Guests of Norwegian Cruise Line began reporting scam emails on October 10, 2026 that quoted their real name, ship, sailing date and booking number and asked them to verify the card on file, sometimes threatening to cancel the cruise. NCL warned guests and said it was investigating. In a breach notice published by Turkey's data protection authority KVKK on November 4, NCL (Bahamas) Ltd. said unauthorized people exploited a vulnerability in a web application it uses to manage reservations and accessed some customers' names, email addresses, dates of birth and reservation numbers, then used them to send the phishing emails. The filing says up to 2,392 people's data may have been accessed; NCL has not published a worldwide figure.

What should I do?

  1. Don't click links in emails asking you to verify your card or complete a security check for your cruise; real NCL emails come only from @ncl.com, @e.ncl.com or @nclcorp.com, and even those can be faked.
  2. If you entered card details on a link from such an email, call your card issuer right away to block the card and dispute charges.
  3. Check your booking by typing ncl.com yourself or calling your travel advisor, never through a link in a message.
  4. Change your NCL account password, and anywhere you reused it.
XRedditWhatsApp

Check the other services you use →

Sources