Carnival Data Breach: 6 Million Travelers' IDs Exposed

One tricked employee exposed nearly 6 million travelers

Carnival has confirmed a data breach affecting close to 6 million people. The stolen data is not trivial — it reportedly includes:

• Names and addresses
• Dates of birth
• Driver's license numbers
• Passport numbers

The way in? Attackers social-engineered a single employee account — no exotic malware, just a convincing lie that got them access to part of Carnival's systems.

Why identity documents change the math

Most breaches leak contact data. This one leaked government identity documents. Passport and driver's license numbers are exactly what's used to open accounts, pass verification checks, and impersonate you — and unlike a password, you can't rotate them.

The breach didn't start with your password. It started with a person at a company you trusted being manipulated, and your identity documents were the payload. That's a pattern you'll keep seeing, and it's why reducing your overall exposure matters more than any single password.

What you can do

• Be alert to identity-verification fraud. Consider a credit freeze, and watch for accounts or inquiries you didn't initiate.
• Shrink your public profile. The less of your address, phone, and family that a criminal can pull from people-search sites, the harder it is to combine this leak into a full, convincing identity.
• Remove and monitor. Get your data off the broker network and keep it off.

GhostMyData scans the data-broker network for your information, removes it, and keeps it removed — automatically. Run a free scan to see how complete your public file already is.

Sources: Malwarebytes, NBC Miami, Cruise Law News, Maine AG filing.