Class Action Claims Margaritaville at Sea Failed to Prevent September 2025 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit claims that Margaritaville at Sea failed to protect its customers’ sensitive personal and health information from a September 2025 data breach.

Get class action lawsuit and settlement news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter.

The 58-page lawsuit against Classica Cruise Operator, Ltd, Inc. claims that Margaritaville at Sea failed to properly secure and protect customers’ personal information from a September 23, 2025 cyberattack perpetrated by ransomware group Lynx. The case says the cybercriminals managed to extract names, dates of birth, addresses, passport details, financial information, Social Security numbers, health data and other personal information belonging to the defendant’s cruise customers.

Lynx, per the suit, has become notorious for targeting sensitive data stored by high-profile U.S. companies and then ransoming the data for millions of dollars, often threatening to release or sell it on the dark web if the group’s demands are not met. The victims of the Margaritaville at Sea data breach, the complaint claims, are now similarly at risk of their data being sold or listed on the dark web for future illegal, harmful use.

Specifically, the lawsuit says that those affected by the Margaritaville at Sea data breach face a heightened risk of:

• Identity theft and fraud, as well as time and money lost discovering and/or mitigating the effects or potential effects of any theft or fraud;
• Delays in the receipt of tax refunds;
• Loss of control over the use of their private information, including unauthorized use of any stolen information;
• The continued compromise or publication of their private information online;
• Invasion of privacy; and
• A continued risk to their private information that remains in the cruise company’s possession for as long as the company, per the suit, similarly fails to properly secure its customers’ data.

Furthermore, the complaint claims that the data breach has also caused proposed class members to lose out on the benefits of their bargain with Margaritaville at Sea, given that transacting with the defendant required the exchange of the now-compromised information.

A 2024 study by communications conglomerate Cisco reported that “privacy has become a critical element and enabler of customer trust, with 94 percent of organizations saying their customers would not buy from them if they did not protect data properly,” with 89 percent of consumers stating that they “care about data privacy,” “[are] willing to spend time and money to protect data” and that they “expect to pay more” for their privacy.

In light of this, the complaint alleges that Margaritaville at Sea not only violated consumers’ trust but failed to provide the expected data security that was, the case argues, a meaningful factor in consumers’ decision to complete their transactions—which included sharing their personal information—with the cruise company.

The filing alleges that Margaritaville at Sea should have known that the information exposed in the data breach was sensitive and a valuable target for cyberattacks, especially given the 211-percent increase in corporate data breaches from 2023 to 2024.

The Margaritaville at Sea class action lawsuit seeks to represent all U.S. residents who were affected by the September 23, 2025 Margaritaville data breach.

Want to learn how to start a class action lawsuit? We’ve got you covered.