The California Office of the Attorney General disclosed a data breach at Royal Caribbean Cruises Ltd. between February 6 and February 18, 2021, where unauthorized actors gained access to employees’ email accounts. The compromised data included highly sensitive personal information such as names, contact details, dates of birth, gender, nationality, passport numbers, state driver’s license numbers, and tokenized or partial payment card information. The breach was formally reported on June 23, 2021, months after the initial intrusion. The incident highlights a significant exposure of internal employee data, raising concerns over identity theft, financial fraud, and potential misuse of government-issued identifiers. While the breach did not directly involve customer records, the nature of the accessed data—particularly passport and driver’s license details—poses long-term risks for affected employees, including phishing attacks, credential stuffing, or targeted scams. The delayed detection and reporting further exacerbate the severity, as the window for exploitation remained open for an extended period. As a global cruise operator handling vast volumes of sensitive data, the breach underscores vulnerabilities in email security protocols and third-party risk management. The exposure of partial payment card data, though tokenized, adds a financial dimension to the reputational and operational fallout. Regulatory scrutiny and potential legal repercussions may follow, given the scope of personally identifiable information (PII) involved.