Carnival Cruise Line revealed it suffered a data breach that may have compromised the personal information of millions of passengers.
The company announced on May 27 that its IT team discovered a cybersecurity breach on April 14 after an “unauthorized actor” gained access to a limited portion of the company’s IT system by deceiving an employee in what it described as a “social engineering” operation.
Carnival said it acted quickly to block the unauthorized activity and hired third-party security experts to bolster its security systems and launch an investigation. About a week later on April 22, Carnival determined that the personal information of passengers was impacted by the breach, including names, addresses, email addresses, phone numbers, dates of birth, and government-issued identification numbers like driver’s license numbers and passport numbers.
While Carnival did not provide specifics on the number of passengers impacted, a company notice filed with the Office of the Maine Attorney General stated 5,995,277 persons were affected by the breach.
The cruise line has been notifying customers who were affected by email and said it is giving impacted individuals two years of free credit monitoring through TransUnion.
In a statement, Carnival said it “deeply regrets this incident and any concern it may cause.”
“Carnival has taken further steps to deploy additional safeguards onto our systems, including implementing enhanced security and monitoring controls,” the company said. “We remain committed to ongoing information security reviews to strengthen our security and privacy programs and controls.”
Carnival is also urging affected individuals to stay vigilant and regularly monitor their account statements and credit histories for signs of identity theft and fraud, and contact local police if they suspect unauthorized activites.
Those with questions about the incident can contact Carnival’s dedicated call center at 1-844-593-8310.
