HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedGovernment IDHealth (basic)MediumContained

Virgin Cruises Intermediate Limited

bd_3d3b02cbd2dc8007 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 1, 2021

Filed

Jul 7, 2021

To disclose

22 weeks

Affected

3state residents only

Confidence

66%

Full breach record for Virgin Cruises Intermediate Limited →

Virgin Cruises Intermediate Limited notified NH AG that unauthorized access to IT logging data on Feb 1, 2021, may have exposed NH residents' government ID numbers and physical condition data. 3 residents affected. Notices sent July 6, 2021. Cybersecurity firm engaged; access terminated.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 22 weeks / 156 days

Feb 1, 2021

Discovered

Jul 7, 2021

Filed

vs. sector median

+15 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident

Name: Virgin Cruises Intermediate Limited
norm: virgin cruises intermediate

Name: Virgin Cruises Intermediate Limited
norm: virgin cruises intermediate
Industry: Retail & Consumerllm

Discovered: Feb 1, 2021
Materiality determined: —
Notification sent: Jul 6, 2021
Affected individuals: 3state-resident count only
Data types: Government IDHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General's office
Initial access: valid_credentials

During the incident: Engaged a leading cybersecurity firm to assist in assessing the scope of the potential incident
Took steps to terminate the unauthorized access
Distributed notification letters to all impacted individuals
Provided individuals with information about steps they can take to protect themselves from identity theft or fraud
Changes made: Taking additional security steps to help prevent future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(156 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/virgin-cruises-intermediate-limited-20210707.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 7, 2021
Raw hash: 9df490bb600c8e4f1c6b245c4abc08e5e248a44e5b164f13113d63e750f2d498

Reporting entityVirgin Cruises Intermediate Limited

Victim entityVirgin Cruises Intermediate Limited

Incidentdiscovered Feb 1, 2021

Stated responseEngaged a leading cybersecurity firm to assist in assessing the scope of the potential incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov