HackingHospitalityTransportation & LogisticsHospitalityCustomer Data InvolvedIdentity (basic)MediumResolved

Carnival Corporation Ltd.

bd_b45cbe1068a6d457 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 19, 2021

Filed

Oct 16, 2021

To disclose

30 weeks

Affected · nationwide

20,99294 in this filing

Linked

9 filings

Confidence

50%

Full breach record for Carnival Corporation Ltd. →6 incidents on file

Carnival Corporation and plc reported a data breach impacting 94 Maine residents, which was discovered on March 19, 2021. The incident, which occurred on March 12, 2021, was described as an external system breach or hacking. The company provided written notification to affected individuals on May 21, 2021, and offered one year of complimentary credit monitoring services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Mar 19, 2021 → Filed with AG Oct 16, 2021211d ⏱ ME AG >30d30 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 7 days

discovery → filing · 30 weeks / 211 days

Mar 12, 2021

Begins

Mar 19, 2021

Discovered

Oct 16, 2021

Filed

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

California State AGbd_1e5e7014d602908c2021-10-18 · +2dVerified
New Hampshire State AGbd_435c6a0551cb95352021-10-18 · +2dVerified
Oregon State AGbd_df459e2ce7c7cf542021-10-18 · +2dVerified
Montana State AGbd_c8917be506d4829a2021-10-06 · +10dVerified

Show 4 more filings ↓up to 288d gap

New Hampshire State AGbd_d4c6571d127bcba22021-05-25 · +144dVerified
Indiana State AGbd_07137f2dac7abdb92021-05-21 · +148dVerified
Montana State AGbd_e54ff2b7a469347a2021-05-21 · +148dVerified
Illinois State AGbd_08bd946f93f53f002021-01-01 · +288dCandidate

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com
Industry: HospitalityllmTransportation & Logisticsllm

Discovered: Mar 19, 2021
Breach occurred: Mar 12, 2021
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 21, 2021
Affected individuals: 20,992state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access

Changes made: Offered one year of free credit monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(211 days from discovery to filing)
Compliance flags: ME AG >30d · 211dME resident >60d · 63d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 19, 2021
→ Filed with AG: Oct 16, 2021
211d 30 days (soft) ME AG >30d
Maine
Discovered: Mar 19, 2021
→ Notified: May 21, 2021
63d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 19, 2021 → Filed with AG: Oct 16, 2021	211d	30 days (soft)	ME AG >30d
Maine	Discovered: Mar 19, 2021 → Notified: May 21, 2021	63d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+140d

Montana State AG+140d

New Hampshire State AG+144d

Montana State AG+278d

Maine State AG+288d · this page

California State AG+290d

New Hampshire State AG+290d

Oregon State AG+290d

Pattern: first filing Jan 1 (IL), last Oct 18 (OR) — a 290-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6e5ffd3e-4185-48e7-a098-a7405ec0ec63.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 16, 2021
Raw hash: 7834a86e2ba900f5bb1b95e4508c0bdeb6652c7c050e792acf517bc4386faabb

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityCarnival Corporation Ltd.

Victim entityCarnival Corporation Ltd.

Incidentdiscovered Mar 19, 2021

Stated responseOffered one year of free credit monitoring services

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov