HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PIIMediumContained

Carnival Corporation Ltd.

bd_c8917be506d4829a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 19, 2021

Filed

Oct 6, 2021

To disclose

29 weeks

Affected

63state residents only

Linked

6 filings

Confidence

64%

Full breach record for Carnival Corporation Ltd. →14 incidents on file

Carnival Corporation notified Montana residents of a data breach detected on March 19, 2021, involving unauthorized access to email accounts. The incident impacted guest, employee, and crew personal information including names, addresses, passport numbers, DOBs, health info, and SSNs. The company engaged a cybersecurity firm, notified regulators, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 29 weeks / 201 days

Mar 15, 2021

Begins

Mar 19, 2021

Discovered

Oct 6, 2021

Filed

vs. sector median

+21 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_b45cbe1068a6d4572021-10-16 · +10dVerified
California State AGbd_1e5e7014d602908c2021-10-18 · +12dVerified by operator
Oregon State AGbd_df459e2ce7c7cf542021-10-18 · +12dVerified
Montana State AGbd_e54ff2b7a469347a2021-05-21 · +138dVerified

Show 1 more filing ↓up to 355d gap

Oregon State AGbd_793b80455e0891bd2020-10-16 · +355dVerified

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com
Industry: Retail & Consumerllm

Discovered: Mar 19, 2021
Breach occurred: Mar 15, 2021 – Mar 19, 2021
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 6, 2021
Affected individuals: 63state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified appropriate regulators
Initial access: valid_credentials

During the incident: Shut down the event and prevent further unauthorized access
Engaged a leading cybersecurity firm to investigate the matter
Notified appropriate regulators
Offering individuals free credit monitoring and identity theft detection services for one year through Cyberscout
Changes made: Regularly review security and privacy policies and procedures
Implement changes to enhance information security and privacy program and controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(201 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Oregon State AGOct 16 · first

Montana State AG+217d

Montana State AG+355d · this page

Maine State AG+365d

California State AG+367d

Oregon State AG+367d

Pattern: first filing Oct 16 (OR), last Oct 18 (OR) — a 367-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-18.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 6, 2021
Raw hash: cb482758f8e46bcbca59a16bd9a59afd3d11ad12dc9a6aa297bf79f93cf60c9b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCarnival Corporation Ltd.

Victim entityCarnival Corporation Ltd.

Incidentdiscovered Mar 19, 2021

Stated responseShut down the event and prevent further unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov