HackingHospitalityTransportation & LogisticsHospitalityCustomer Data InvolvedIdentity (basic)MediumResolved

Carnival Corporation Ltd.

bd_b45cbe1068a6d457 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 19, 2021

Filed

Oct 16, 2021

To disclose

30 weeks

Affected · nationwide

20,99294 in this filing

Linked

6 filings

Confidence

50%

Full breach record for Carnival Corporation Ltd. →14 incidents on file

Carnival Corporation and plc reported a data breach impacting 94 Maine residents, which was discovered on March 19, 2021. The incident, which occurred on March 12, 2021, was described as an external system breach or hacking. The company provided written notification to affected individuals on May 21, 2021, and offered one year of complimentary credit monitoring services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Mar 19, 2021 → Filed with AG Oct 16, 2021211d ✗ ME AG >90d30 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 7 days

discovery → filing · 30 weeks / 211 days

Mar 12, 2021

Begins

Mar 19, 2021

Discovered

Oct 16, 2021

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_1e5e7014d602908c2021-10-18 · +2dVerified by operator
Oregon State AGbd_df459e2ce7c7cf542021-10-18 · +2dVerified
Montana State AGbd_c8917be506d4829a2021-10-06 · +10dVerified
Montana State AGbd_e54ff2b7a469347a2021-05-21 · +148dVerified

Show 1 more filing ↓up to 365d gap

Oregon State AGbd_793b80455e0891bd2020-10-16 · +365dVerified

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com
Industry: HospitalityllmTransportation & Logisticsllm

Discovered: Mar 19, 2021
Breach occurred: Mar 12, 2021
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 21, 2021
Affected individuals: 20,992state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access

Changes made: Offered one year of free credit monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(211 days from discovery to filing)
Compliance flags: ME AG >90d · 211dME resident >60d · 63d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 19, 2021
→ Filed with AG: Oct 16, 2021
211d 90 days ME AG >90d
Maine
Discovered: Mar 19, 2021
→ Notified: May 21, 2021
63d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 19, 2021 → Filed with AG: Oct 16, 2021	211d	90 days	ME AG >90d
Maine	Discovered: Mar 19, 2021 → Notified: May 21, 2021	63d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Oregon State AGOct 16 · first

Montana State AG+217d

Montana State AG+355d

Maine State AG+365d · this page

California State AG+367d

Oregon State AG+367d

Pattern: first filing Oct 16 (OR), last Oct 18 (OR) — a 367-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6e5ffd3e-4185-48e7-a098-a7405ec0ec63.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 16, 2021
Raw hash: 7834a86e2ba900f5bb1b95e4508c0bdeb6652c7c050e792acf517bc4386faabb

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCarnival Corporation Ltd.

Victim entityCarnival Corporation Ltd.

Incidentdiscovered Mar 19, 2021

Stated responseOffered one year of free credit monitoring services

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov