Social EngineeringRetail & ConsumerRetailPhishingData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDPIIHighContained

Carnival Corporation Ltd.

bd_2fa8add804519bbe · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 14, 2026

Filed

May 28, 2026

To disclose

6 weeks

Affected

46,241state residents only

Linked

16 filings

Confidence

66%

Full breach record for Carnival Corporation Ltd. →14 incidents on file

Carnival Corporation notified Massachusetts residents of a cybersecurity event on May 27, 2026. On April 14, 2026, an unauthorized actor used social engineering/phishing to gain access to an employee account and copy personal information. The company blocked the activity, engaged third-party security experts, and is offering 24 months of complimentary TransUnion credit monitoring. The specific data elements are redacted in this template but include PII.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d6 weeks discovery → filing

Incident timeline

discovery → filing · 6 weeks / 44 days

Apr 14, 2026

Discovered

May 28, 2026

Filed

vs. sector median

1 wks faster

This filing is one of 16 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Texas State AGbd_104c3479219b55d22026-05-28Verified
Vermont State AGbd_a217ec232607f2bd2026-05-28Verified
South Carolina State AGbd_b40f7e0268a40f142026-05-28Verified
Washington State AGbd_06ca13775dc757a32026-05-27 · +1dVerified

Show 6 more filings ↓up to 1d gap

Nebraska State AGbd_1a1bc5215fd93cf02026-05-27 · +1dVerified
Maine State AGbd_24671352cfb8e0c52026-05-27 · +1dVerified
Indiana State AGbd_403cc5ab7d0963812026-05-27 · +1dVerified
Oregon State AGbd_6d8af3869b6bca552026-05-27 · +1dVerified
California State AGbd_843aca78131302882026-05-27 · +1dVerified
Delaware State AGbd_aa341ce145e41ff42026-05-27 · +1dVerified

Showing first 10 of 15 linked disclosures.

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com
Industry: Retail & Consumerllm

Discovered: Apr 14, 2026
Materiality determined: —
Notification sent: May 27, 2026
Affected individuals: 46,241state-resident count only
Data types: Identity (basic)Government IDPII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Blocked the unauthorized activity
Began working with third party security experts to further strengthen our security and to conduct a thorough investigation
Offering you a complimentary 24-month membership to TransUnion’s credit monitoring
Changes made: Enhancing our security and monitoring controls
Advance its IT security and data privacy controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Washington State AGMay 27 · first

Nebraska State AGMay 27 · first

Maine State AGMay 27 · first

Indiana State AGMay 27 · first

Oregon State AGMay 27 · first

California State AGMay 27 · first

Delaware State AGMay 27 · first

Texas State AG+1d

Vermont State AG+1d

South Carolina State AG+1d

Massachusetts State AG+1d · this page

Cascade drawn from the first 10 linked disclosures of 15 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-857-carnival-corporation/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 28, 2026
Raw hash: 406f01e09091a42b33e5d57ffcc8b95a515e0f8491623303c1ca7036b3d90216

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityCarnival Corporation Ltd.

Victim entityCarnival Corporation Ltd.

Incidentdiscovered Apr 14, 2026

Stated responseBlocked the unauthorized activity

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov