06/01/2026
🚨 TEXAS CRUISE PASSENGERS ALERT 🚨
Thousands of Texans who sailed with Carnival could be at risk after the company revealed a cybersecurity breach exposed sensitive personal information — including passport and driver’s license numbers.
Carnival says hackers gained access to part of its system in April after tricking an employee through a social engineering attack. The stolen data may include:
🔺 Names
🔺 Addresses
🔺 Email addresses
🔺 Phone numbers
🔺 Dates of birth
🔺 Passport and driver’s license information
The breach could heavily impact Texas travelers, especially with Houston and the Port of Galveston serving as major cruise hubs for Carnival passengers across the Gulf Coast. 🚢
Carnival says law enforcement and cybersecurity experts are now investigating, but the company has not revealed how many people were affected nationwide.
Here is the letter you will receive:
June 1, 2026
Re: Notice of Cybersecurity Event
DEAR CUSTOMER NAME:
Carnival Corporation (the “Company”), the parent of Carnival Cruise Line, values the trust you place in us and takes the privacy and security of your information seriously. Unfortunately, we are writing to inform you of a recent cybersecurity event affecting certain of your personal information. We deeply regret this incident and any concern it may cause. Please read this notice carefully to learn what happened and what we are doing, as well as information on how you can obtain complimentary credit monitoring services.
What happened:
On April 14, 2026, the Company’s IT security team identified unauthorized activity involving an employee’s account. An unauthorized actor used social engineering to deceive an employee to gain access to a limited portion of the Company’s IT system. The Company acted swiftly to block the unauthorized activity and immediately began working with third party security experts to further strengthen our security and to conduct a thorough investigation. On April 22, 2026, the Company first determined that the bad actor illegally copied personal information.
What Personal Information was involved:
The Company has been conducting a thorough and time‑consuming analysis of the impacted files to determine what personal information they contained and to whom that information belongs. We have determined that your full name, address, email address, phone number, and passport number were obtained.
What we are doing:
We are offering you a complimentary 24‑month membership to TransUnion’s credit monitoring. To activate your membership and start monitoring your personal information, please follow the steps below:
Ensure that you enroll by: August 31, 2026 (Your code will not work after this date).
Visit the TransUnion website to enroll.
– For Adults: www.mytrueidentity.com
Provide your activation code (see attachment A)
You must enroll by August 31, 2026 to receive these services.
Please see Attachment A for additional details regarding these services.
In addition to the enterprise‑wide security measures the Company had in place prior to the incident, we have taken steps to further safeguard our systems, including enhancing our security and monitoring controls. The Company will continue to advance its IT security and data privacy controls to stay ahead of an ever‑evolving threat landscape.
What you can do:
In addition to enrolling in the credit monitoring being offered to you at no charge, we encourage you to take the following precautions:
Remain vigilant against threats of identity theft or fraud and regularly review and monitor your account statements and credit history for any signs of unauthorized transactions or activity.
If you ever suspect that you are the victim of identity theft or fraud, you can contact your local police. Additional information about how to protect your identity is contained in Attachment B.
For more information:
The Company has established a dedicated call center to answer questions about the cybersecurity event as well as the TransUnion services that we are offering to you. If you have any questions, please call the TransUnion call center at 1‑844‑593‑8310, from 8 a.m. to 8 p.m. ET Monday through Friday, excluding major U.S. holidays.
Sincerely,
Carnival Corporation
3655 N.W. 87th Avenue
Miami, Florida 33178
+1 305‑599‑2600
Attachment A – ADDITIONAL DETAILS REGARDING YOUR 24-MONTH TRANSUNION
CREDIT MONITORING SERVICES
To activate your membership and start monitoring your personal information please follow the steps below:
For adults:
In response to the incident, we are providing you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge. These services provide you with alerts for twenty‑four (24) months from the date of enrollment when changes occur to your credit file. This notification is sent to you the same day that the change or update takes place with the bureau. Finally, we are providing you with proactive fraud assistance to help with any questions that you might have or in the event that you become a victim of fraud. These services will be provided by Cyberscout, a TransUnion company specializing in fraud assistance and remediation services.
To enroll in Credit Monitoring services at no charge, please log on to www.mytrueidentity.com and follow the instructions provided. When prompted please provide the following unique code to receive services: ############X
In order for you to receive the monitoring services described above, you must enroll within 90 days from the date of this letter. The enrollment requires an internet connection and e‑mail account and may not be available to minors under the age of 18 years of age. Please note that when signing up for monitoring services, you may be asked to verify personal information for your own protection to confirm your identity.
Attachment B–Information for U.S. customers
MORE INFORMATION ABOUT IDENTITY PROTECTION
INFORMATION ON OBTAINING A FREE CREDIT REPORT
U.S. customers are entitled under U.S. law to one free credit report annually from each of the three major credit bureaus. To order your free credit reports, visit www.annualcreditreport.com or call toll-free +1 (877) 322‑8228.
INFORMATION ON IMPLEMENTING A FRAUD ALERT OR A SECURITY FREEZE
You can contact the three major credit bureaus at the addresses below to place a fraud alert on your credit report. A fraud alert indicates to anyone requesting your credit file that you suspect you are a possible victim of fraud. A fraud alert does not affect your ability to get a loan or credit. Instead, it alerts a business that your personal information might have been compromised and requires that business to verify your identity before issuing you credit. Although this may cause some short delay if you are the one applying for the credit, it might protect against someone else obtaining credit in your name.
A security freeze prohibits a credit reporting agency from releasing any information from a consumer’s credit report without written authorization. However, please be aware that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit, mortgages, employment, housing, or other services. A credit reporting agency may not charge you to place, temporarily lift, or permanently remove a security freeze.
To place a fraud alert or a security freeze on your credit report, you must contact the three credit bureaus below:
Equifax Experian TransUnion
Consumer Fraud Division
P.O. Box 740256
Atlanta, GA 30374
(888) 766‑0008
www.equifax.com Credit Fraud Center
P.O. Box 9554
Allen, TX 75013
(888) 397‑3742
www.experian.com TransUnion LLC
P.O. Box 2000
Chester, PA 19022‑2000
(800) 680‑7289
www.transunion.com
To request a security freeze, you will need to provide the following information:
1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.);
2. Social Security number;
3. Date of birth;
4. If you have moved in the past five (5) years, the addresses where you have lived over those prior five (5) years;
5. Proof of current address such as a current utility bill or a telephone bill; and
6. A legible photocopy of a government-issued identification card (state driver’s license or ID card, military identification, etc.).
You may also contact the U.S. Federal Trade Commission (FTC) for further information on fraud alerts, security freezes, and how to protect yourself from identity theft. The FTC can be contacted at 400 7th St. SW, Washington, DC 20024; telephone +1 (877) 382‑4357 or www.consumer.gov/idtheft.
ADDITIONAL RESOURCES
Your state Attorney General may also have advice on preventing identity theft, and you should report instances of known or suspected identity theft to law enforcement, your state Attorney General, or the FTC.
California residents: Visit the California Office of Privacy Protection (https://oag.ca.gov/privacy) for additional information on protection against identity theft.
District of Columbia residents: The District of Columbia Attorney General may be contacted at: 400 6th Street, NW, Washington, DC 20001; +1 (202) 727‑3400, [email protected] and www.oag.dc.gov.
Iowa residents: The Attorney General can be contacted at the Office of Attorney General of Iowa, Hoover State Office Building, 1305 E. Walnut Street, Des Moines, Iowa 50319; +1 (515) 281‑5164, www.iowaattorneygeneral.gov.
Kentucky residents: The Attorney General can be contacted at Office of the Attorney General of Kentucky, 700 Capitol Avenue, Suite 118 Frankfort, Kentucky 40601, www.ag.ky.gov, Telephone: +1 (502) 696‑5300.
Maryland residents: The Attorney General can be contacted at Office of Attorney General, 200 St. Paul Place, Baltimore, Maryland 21202; +1 (888) 743‑0023 or www.marylandattorneygeneral.gov.
Massachusetts residents: Under Massachusetts law, you have the right to obtain any police report filed in connection with the cybersecurity event. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it.
North Carolina residents: The Attorney General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699‑9001; +1 (919) 716‑6400 or www.ncdoj.gov.
New Mexico residents: You have rights under the federal Fair Credit Reporting Act (FCRA), which governs the collection and use of information pertaining to you by consumer reporting agencies. For more information about your rights under the FCRA, please visithttps://www.ftc.gov/system/files/ftc_gov/pdf/fcra-march-2026.pdf or www.ftc.gov.
New York residents: The Attorney General can be contacted at the Office of the Attorney General, The Capitol, Albany, NY 12224‑0341; +1 (800)‑771‑7755 or www.ag.ny.gov.
Oregon residents: The Attorney General can be contacted at Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301‑4096; +1 (877) 877‑9392 (toll‑free in Oregon), +1 (503) 378‑4400, or www.doj.state.or.us.
Rhode Island residents: The Attorney General can be contacted at 150 South Main Street, Providence, Rhode Island 02903; +1 (401) 274‑4400 or www.riag.ri.gov. You may also file a police report by contacting local or state law enforcement agencies.
For Arizona, California, District of Columbia, Iowa, Montana, North Carolina, Washington and West Virginia residents: You may obtain one or more (depending on the state) additional copies of your credit report, free of charge. You must contact each of the credit bureaus directly to obtain such additional report(s).
