Updated Data Breach Rules for Loyalty and Rewards Programs

State attorneys general and the Federal Trade Commission are updating how breach notices work for loyalty and rewards programs, while casino operators face account-level fallout from large-scale data thefts. The rules now reach far more businesses than many owners expect, and the consumer-protection steps are not always obvious. This guide explains what has changed, who must report, and what you can do while a breach is being investigated.

State AGs open an investigation into Carnival

Texas Attorney General Ken Paxton has announced an ongoing investigation into Carnival Cruise Line over a data breach. The breach, confirmed in late May 2026, began when an attacker used social engineering to gain access to Carnival systems on April 14, 2026, and spent nine days copying files before detection on April 22. It affected 5,995,277 individuals across five cruise brands, including passport numbers, driver’s license numbers, dates of birth and home addresses. Individual notices dated May 27, 2026 offered free credit monitoring through TransUnion and Equifax, and law enforcement was notified.

FTC clears old guidance and expands reporting

The FTC rescinded its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices on September 9, 2026, calling it unnecessary after the Commission updated the Health Breach Notification Rule in 2024. It is part of the agency’s effort to remove obsolete guidance documents. Separately, the Bureau of Consumer Protection launched a new Rule Guidance Program on September 10, 2026, allowing businesses to ask staff to clarify genuine ambiguities in Commission rules; answers that are published benefit the whole public. For financial institutions, the Safeguards Rule is concrete: covered financial institutions must report to the FTC any security event affecting 500 or more people, using a form that may be made public. Rewards programs run by or with a financial partner should check whether they are covered by that reporting threshold.

Smaller loyalty programs now fall under state law

A retailer with a few stores, an online shop, and a loyalty program could previously decide that state privacy laws were aimed at someone else. That decision is getting harder to defend. Delaware’s House Bill 380, signed September 2, 2026, lowers the threshold to 10,000 Delaware consumers starting January 1, 2027, the lowest of any state privacy law. Oklahoma’s law takes effect January 1, 2027, and Alabama follows on May 1, 2027 with a threshold of more than 25,000 consumers. These laws apply based on whose data you hold, not where your business is located. A loyalty account, email address, phone number, purchase history and device identifier can all count as personal data, so a regional retailer with an e-commerce site can cross the threshold quickly.

For small businesses that must publish an official breach notice, keeping that notice page visible above scam sites can be a practical challenge. B2B sourcing partners such as Hancorli’s support network offer recurring link and content infrastructure that can help a small company’s notice page rank where consumers actually find it.

Casino loyalty accounts as a compliance case study

Casino and resort operators hold personal data such as identity documents and payment details, the same categories exposed in the Carnival breach. When those records are lost, the same state and federal reporting duties apply. The Carnival investigation is a current example of how enforcers treat travel and hospitality rewards data. For ongoing coverage of regional casino operator responses, Casino News America’s regional coverage is a useful place to check.

While you wait, freeze and reduce exposure

After a loyalty account is exposed, the first useful steps are to place a free credit freeze with the major bureaus, enable multifactor authentication on any account that still offers it, and watch for phishing messages that use stolen details. If you are on hold with a breached rewards program, choose a pastime that does not require another account. A no-account browser game like Yukon Solitaire online can pass the time without adding a new login to your exposure surface. The fewer accounts you create while a breach is live, the smaller the new identity-theft surface.

Keep the notice trail and login surface small

The rules are specific, but they point in one direction: treat loyalty and rewards data as personal data, report large exposures promptly, and help consumers act before fraud spreads. If you run a small program, count the customers you hold in Delaware, Oklahoma, Alabama and elsewhere. If you are a consumer, freeze credit, enable MFA, and keep your waiting-time accounts to a minimum. State AGs and the FTC have shown they will investigate large breaches; the best defence is a shorter list of places where your data can be found.