HackingStolen CredentialsCustomer Data InvolvedData ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICMediumActive

Carnival Corporation Ltd.

bd_7f27ae5a99b9692f · schema v1 · pii pii-v1

Full breach record for Carnival Corporation Ltd. →

Carnival disclosed a security event in late May 2019 involving unauthorized access to employee email accounts containing guest personal information between April 11 and July 23, 2019. Impacted data included names, addresses, SSNs, government IDs, credit card info, and health data. Carnival engaged forensic experts, notified law enforcement, and offered free credit monitoring.

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

bd_a5d9e7922483dc25California State AGfiled 2020-03-03(1d gap)Candidate
bd_ab0adfeb7caa7d91South Carolina State AGfiled 2020-03-06(4d gap)Verified

Source provenance

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2020/06/Carnival-Sample-Consumer-Notification-US.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 2, 2020
Raw hash: 26111770ebb8cb96eab7052d565e266cda75bcf5007493abc4dd1159dfa02c14

Reporting entity

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com

Victim entity

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com

Incident

Discovered: May 31, 2019
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASIC
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

Compliance

Time to disclose: 39 weeks(276 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Extraction provenance

Status: No extraction artifact recorded for this disclosure.