Social EngineeringHospitalityHospitalityPhishingStolen CredentialsTargetedData ExfiltratedIdentity (basic)Government IDPIIHighContained

Carnival Corporation Ltd.

bd_06ca13775dc757a3 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 14, 2026

Filed

May 27, 2026

To disclose

6 weeks

Affected

54,960state residents only

Linked

17 records

Confidence

71%

Full breach record for Carnival Corporation Ltd. →6 incidents on file

Carnival Corporation reported a cybersecurity event in Washington affecting 54,960 individuals. Unauthorized access occurred between April 10-14, 2026, via social engineering/phishing against an employee account. Personal information was copied. The company engaged third-party security experts and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 4 days

discovery → filing · 6 weeks / 43 days

Apr 10, 2026

Begins

Apr 14, 2026

Discovered

May 27, 2026

Filed

This filing is one of 17 records about the same incident.View merged incident

A leak claim by shinyhunters about this victim was first seen 38 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Nebraska State AGbd_1a1bc5215fd93cf02026-05-27Verified
Maine State AGbd_24671352cfb8e0c52026-05-27Verified
Indiana State AGbd_403cc5ab7d0963812026-05-27Verified
Oregon State AGbd_6d8af3869b6bca552026-05-27Verified

Show 6 more filings ↓up to 1d gap

California State AGbd_843aca78131302882026-05-27Verified
Delaware State AGbd_aa341ce145e41ff42026-05-27Verified
Texas State AGbd_104c3479219b55d22026-05-28 · +1dVerified
Massachusetts State AGbd_2fa8add804519bbe2026-05-28 · +1dVerified
Vermont State AGbd_a217ec232607f2bd2026-05-28 · +1dVerified
South Carolina State AGbd_b40f7e0268a40f142026-05-28 · +1dVerified

Showing first 10 of 16 linked disclosures.

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com
Industry: Hospitalityllm

Discovered: Apr 14, 2026
Breach occurred: Apr 10, 2026 – Apr 14, 2026
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 27, 2026
Affected individuals: 54,960state-resident count only
Data types: PIIIdentity (basic)
Data elements: NameDriver's licence numberDate of birthPassport number
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Blocked the unauthorized activity
Began working with third party security experts to further strengthen our security and to conduct a thorough investigation
Offering you a complimentary 24-month membership to TransUnion’s credit monitoring
Changes made: Enhancing our security and monitoring controls
Advance its IT security and data privacy controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: WA AG >30dLeak >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Nebraska State AGMay 27 · first

Maine State AGMay 27 · first

Indiana State AGMay 27 · first

Oregon State AGMay 27 · first

California State AGMay 27 · first

Delaware State AGMay 27 · first

Washington State AGMay 27 · first · this page

Texas State AG+1d

Massachusetts State AG+1d

Vermont State AG+1d

South Carolina State AG+1d

Cascade drawn from the first 10 linked disclosures of 16 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41079.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 27, 2026
Raw hash: e47359f56bf4fd083a6f1b24107168ecf72252b210b291e086274fa5e392f0a2

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityCarnival Corporation Ltd.

Victim entityCarnival Corporation Ltd.

Incidentdiscovered Apr 14, 2026

Stated responseBlocked the unauthorized activity

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com