HackingRetail & ConsumerRetailCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PIIMediumContained

Carnival Corporation Ltd.

bd_1c3ab84ff5393d16 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 15, 2020

Filed

Dec 4, 2021

To disclose

16 months

Affected

Not disclosed

Confidence

66%

Full breach record for Carnival Corporation Ltd. →14 incidents on file

Carnival Corporation notified Delaware AG of unauthorized third-party access to IT systems detected on August 15, 2020. Access occurred in early August 2020, impacting guest, employee, and crew data including names, addresses, passport numbers, DOB, and potentially SSN/health info. Company engaged cybersecurity firm, notified law enforcement, and offers 12 months credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 14 days

discovery → filing · 16 months / 476 days

Aug 1, 2020

Begins

Aug 15, 2020

Discovered

Dec 4, 2021

Filed

vs. sector median

+61 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com
Industry: Retail & Consumerllm

Discovered: Aug 15, 2020
Breach occurred: Aug 1, 2020
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 11, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified appropriate regulators
Initial access: exploit_public_facing

During the incident: Shut down the intrusion
Restored operations
Engaged a major cybersecurity firm to investigate
Notified law enforcement and appropriate regulators
Changes made: Offering individuals free credit monitoring and identity theft detection services for 12 months through CyberScout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 months(476 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2021/02/US-Adult-Guest-Sample.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 4, 2021
Raw hash: 738aa06e2eea553ef54f25f4c03b5acfc37e86dfc494f6044bbea88e1c4980c9

Reporting entityCarnival Corporation Ltd.

Victim entityCarnival Corporation Ltd.

Incidentdiscovered Aug 15, 2020

Stated responseShut down the intrusion

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov