Just one note---unlike most class action suits that only the private lawyers make out well, this suit was by State's Attorney Generals, so the citizens of the state received the benefit, not the attorneys.
And one other thing---Carnival has no excuse for allowing a data breach of sensitive personal information. It is their responsibility to keep it protected.