Your passport number leaked, not your passport — what Carnival Corporation's data breach means for travelers

Carnival says it began notifying affected people by email on or about May 27, 2026, where an address was available, and posted a substitute notice on its corporate website for people it could not reach. Each email states which items were involved for you. The notice does not list which of the group's brands affected guests sailed with, so anyone who has booked with a Carnival Corporation brand should check, including travelers outside the US. Questions go to the dedicated call center at 1-844-593-8310 (8 a.m.–8 p.m. ET, Mon–Fri).

The leaked items are the ingredients of a convincing message: your name, contact details, date of birth and an ID number. Messages about a "refund for the incident", "passport re-verification before your next sailing" or "updating your booking details" are the ones to distrust. Do not open the link; go to the cruise line's website or app by typing the address yourself (see What is phishing?). A caller who reads out your passport number has not proved anything; that number is exactly what leaked.

Carnival offered two years of free credit monitoring to people in the US; the sample letter set an enrollment deadline of August 31, 2026. Independently of that offer, the FTC says a credit freeze is free, does not affect your credit score, lasts until you lift it, and while it is in place nobody can open a new credit account in your name. You must contact Equifax, Experian and TransUnion separately. Carnival's own FAQ calls a freeze or fraud alert an individual decision; for a leak that includes date of birth and an ID number, this site recommends it.

The US State Department says that after you report a valid passport lost or stolen, you cannot use it for international travel even if you find it later, and reporting it does not replace it; online reports cancel the passport within one business day. That process is built for a passport that is physically gone. If your passport is in your drawer and only its number appeared in this breach, reporting it would cancel a valid document and leave you applying for a new one.

If the physical passport is missing, the answer flips: report it at once. For US passports, the State Department accepts reports online, by mail with Form DS-64, or in person when applying for a new passport. For Japanese passports, Japan's Ministry of Foreign Affairs says a passport reported lost becomes invalid and cannot be used even if found, and that you can file the loss report and a new application at the same time.

The individual notices are in English, but follow-on messages do not have to be. Treat Japanese-language emails or SMS about "your cruise", "a refund" or "passport information" the same way: no links, check through the official site. If you are worried about accounts being opened in your name in Japan, the credit-bureau self-declaration explained in the Times Car breach article is one option; ask each bureau whether a leaked number qualifies.

Staff who handle bookings rarely need to export passport numbers. Let them view one guest's record when needed, and give no everyday account the ability to read the whole table. That way, a deceived employee's account exposes a few records, not the whole table.

Passport details are usually collected for boarding and border formalities. After the trip, list which rules require keeping them and for how long, and delete the rest automatically. Data that no longer exists cannot be copied.

Publish, before anything happens, that you will never ask for a passport number by email or phone, and where guests can check messages. After a breach, that sentence is what lets guests ignore the fakes. The broader baseline is in The minimum security baseline for organizations.