Social EngineeringRetail & ConsumerRetailPhishingCustomer Data InvolvedPIIIdentity (basic)HighContained

Carnival Corporation Ltd.

bd_b40f7e0268a40f14 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 14, 2026

Filed

May 28, 2026

To disclose

6 weeks

Affected

134,156state residents only

Linked

17 records

Confidence

65%

Full breach record for Carnival Corporation Ltd. →6 incidents on file

Carnival Corporation notified South Carolina residents of a cybersecurity event on May 27, 2026. On April 14, 2026, unauthorized activity involving an employee's account was identified. An unauthorized actor used social engineering to gain access to a limited portion of the Company's IT system. The Company blocked the activity and engaged third-party security experts. Personal information was illegally copied starting April 22, 2026. The Company is offering 24 months of complimentary credit monitoring through TransUnion.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d6 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 6 weeks / 44 days

Apr 14, 2026

Discovered

May 28, 2026

Filed

vs. sector median

3 wks faster

This filing is one of 17 records about the same incident.View merged incident

A leak claim by shinyhunters about this victim was first seen 39 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Texas State AGbd_104c3479219b55d22026-05-28Verified
Massachusetts State AGbd_2fa8add804519bbe2026-05-28Verified
Vermont State AGbd_a217ec232607f2bd2026-05-28Verified
Washington State AGbd_06ca13775dc757a32026-05-27 · +1dVerified

Show 6 more filings ↓up to 1d gap

Nebraska State AGbd_1a1bc5215fd93cf02026-05-27 · +1dVerified
Maine State AGbd_24671352cfb8e0c52026-05-27 · +1dVerified
Indiana State AGbd_403cc5ab7d0963812026-05-27 · +1dVerified
Oregon State AGbd_6d8af3869b6bca552026-05-27 · +1dVerified
California State AGbd_843aca78131302882026-05-27 · +1dVerified
Delaware State AGbd_aa341ce145e41ff42026-05-27 · +1dVerified

Showing first 10 of 16 linked disclosures.

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com
Industry: Retail & Consumerllm

Discovered: Apr 14, 2026
Materiality determined: —
Notification sent: May 27, 2026
Affected individuals: 134,156state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Blocked the unauthorized activity
Began working with third party security experts to further strengthen our security and to conduct a thorough investigation
Offering you a complimentary 24-month membership to TransUnion’s credit monitoring
Changes made: Enhancing our security and monitoring controls
Advance its IT security and data privacy controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: Leak >30dSC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Washington State AGMay 27 · first

Nebraska State AGMay 27 · first

Maine State AGMay 27 · first

Indiana State AGMay 27 · first

Oregon State AGMay 27 · first

California State AGMay 27 · first

Delaware State AGMay 27 · first

Texas State AG+1d

Massachusetts State AG+1d

Vermont State AG+1d

South Carolina State AG+1d · this page

Cascade drawn from the first 10 linked disclosures of 16 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2026/Consumer%20Letter%20-%20Carnival%20Corporation.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 28, 2026
Raw hash: 8aee89101c037a0ecdda00e2253855f71d86e07247529e3f84e3b308c7dd7d23

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityCarnival Corporation Ltd.

Victim entityCarnival Corporation Ltd.

Incidentdiscovered Apr 14, 2026

Stated responseBlocked the unauthorized activity

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov