DisclosureLens
UnknownOtherCustomer Data InvolvedPIIIdentity (basic)HighContained

Carnival Corporation Ltd.

bd_24671352cfb8e0c5 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 14, 2026

Filed

May 27, 2026

To disclose

6 weeks

Affected · nationwide

5,995,2779,746 in this filing

Linked

16 filings

Confidence

58%
Full breach record for Carnival Corporation Ltd. →14 incidents on file

Carnival Corporation reported a data breach occurring on April 10, 2026, discovered on April 14, 2026. The incident affected 5,995,277 individuals nationwide, including 9,746 Maine residents. Notification was sent electronically on May 27, 2026. Affected individuals were offered 24 months of credit monitoring and fraud assistance through TransUnion. The specific nature of the breach and data types were not detailed in the filing.

Maine clockDiscovered Apr 14, 2026 → Filed with AG May 27, 202643d ⏱ ME AG >30d6 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 4 days
discovery → filing · 6 weeks / 43 days

Apr 10, 2026

Begins

Apr 14, 2026

Discovered

May 27, 2026

Filed

vs. sector median

2 wks faster

This filing is one of 16 about the same incident.View merged incident
A leak claim by shinyhunters about this victim predates this filing by 39 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Show 6 more filings ↓up to 1d gap

Showing first 10 of 15 linked disclosures.

Filing propagation · 11 filings · 11 states

View merged incident ↗
Washington State AGMay 27 · first
Nebraska State AGMay 27 · first
Indiana State AGMay 27 · first
Oregon State AGMay 27 · first
California State AGMay 27 · first
Delaware State AGMay 27 · first
Maine State AGMay 27 · first · this page
Texas State AG+1d
Massachusetts State AG+1d
Vermont State AG+1d
South Carolina State AG+1d

Cascade drawn from the first 10 linked disclosures of 15 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.