What the Lawsuit Alleges
A class action, Pottle v. Carnival Corp., was filed in federal court in Florida in April 2026 on behalf of plaintiff Zachary Pottle and other affected customers, alleging Carnival Corporation, which owns Carnival Cruise Line, failed to promptly notify customers about a data breach that occurred on April 18, 2026. According to the complaint, the breach involved the theft of more than 8.7 million records containing personally identifiable information, allegedly carried out by a ransomware group known as ShinyHunters.
The lawsuit alleges Carnival failed to adopt reasonable security measures to protect the personal information it collected from customers, despite economically benefiting from that data, and that the delayed or absent notification left affected individuals at increased risk of identity theft and fraud without the ability to take timely protective steps. The complaint asserts claims of negligence and violations of state and federal consumer protection statutes.
What the Plaintiff Is Seeking
The plaintiff seeks to represent a nationwide class of everyone in the United States affected by the breach, along with class certification, damages, and a jury trial. Alleged injuries described in the complaint include the loss of value of the stolen personal information itself, out-of-pocket costs related to identity theft prevention and recovery, and an increased ongoing risk of identity theft.
As of this update, Carnival has not been reported to have publicly responded in detail to the specific allegations in this lawsuit, and the case remains in its early stages, with no ruling on class certification or settlement reached.
This Is One of Several Recent Carnival Legal Matters
Carnival Corporation has faced a range of other lawsuits in recent years, including passenger injury claims arising from onboard accidents, negligence claims tied to COVID-19 exposure earlier in the pandemic, and past class actions over issues like canceled charter cruises and vacation protection insurance sales practices. Passenger injury claims on cruise ships are generally governed by maritime law, which has its own rules distinct from ordinary personal injury claims on land.
This particular data breach lawsuit is a separate and more recent matter, concerning cybersecurity and data privacy rather than an onboard incident, and its outcome will depend on evidence about Carnival specific security practices and notification timeline, which remain to be developed through litigation.
How to Get Legal Help
If you have cruised with Carnival and are concerned your information may have been affected by the 2026 breach, watch for an official notification from Carnival or a settlement administrator rather than responding to unsolicited emails or calls, since data breach notifications are also commonly used in phishing scams. Monitoring your credit and financial accounts is a reasonable precaution regardless of whether you receive a formal notice.
To follow any further developments, bookmark this page and subscribe to LawsuitWatch alerts.
Free Legal Evaluation
Do You Qualify to File a Claim?
Our network of verified plaintiff attorneys offers free, no-obligation case evaluations. Contingency fee representation means you pay nothing unless you win.
Carnival Cruise Lawsuit: The 2026 Data Breach Class Action: Frequently Asked Questions
Answers to the most common questions about this case and your legal options.
What does the Carnival lawsuit allege?
That Carnival Corporation failed to promptly notify customers after a ransomware attack on April 18, 2026, exposed more than 8.7 million records of personal information, and failed to adopt reasonable security measures to protect that data.
Who is behind the breach?
The complaint attributes the breach to a ransomware group known as ShinyHunters, which allegedly stole the records.
Who can join the lawsuit?
The plaintiff seeks to represent anyone in the United States affected by the breach. As with most class actions, there is generally nothing you need to do to be considered part of the case at this early stage.
Has Carnival settled or admitted wrongdoing?
No. As of this update, the case remains in its early stages, with no ruling on class certification, admission of wrongdoing, or settlement.
Is this related to other Carnival lawsuits, like injury claims?
No. This data breach case is separate from other Carnival litigation involving onboard passenger injuries or past COVID-19 related claims, which involve different facts and generally different legal theories, including maritime law for onboard incidents.