HackingRetail & ConsumerHospitalityRetailCustomer Data InvolvedEmployee Data InvolvedTargetedIdentity (basic)Government IDHealth (basic)HighContained

Carnival Corporation Ltd.

bd_d7516eeb9dc1ce1f · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 15, 2020

Filed

Oct 20, 2020

To disclose

9 weeks

Affected

5,801state residents only

Linked

11 filings

Confidence

66%

Full breach record for Carnival Corporation Ltd. →6 incidents on file

Carnival Corporation & plc filed a substitute notice of data breach in South Carolina on October 13, 2020, updating a prior August 2020 disclosure. Unauthorized third-party access occurred in early August 2020, detected on August 15, 2020. Impacted data includes names, addresses, passport numbers, DOBs, and potentially SSNs and health info for guests, employees, and crew. Investigation ongoing; low likelihood of misuse. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 14 days

discovery → filing · 9 weeks / 66 days

Aug 1, 2020

Begins

Aug 15, 2020

Discovered

Oct 20, 2020

Filed

vs. sector median

on median

This filing is one of 11 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

New Hampshire State AGbd_4e0ccec4f7c6c50c2020-10-20Verified
Massachusetts State AGbd_e40607437aac5a3d2020-10-18 · +2dVerified
Oregon State AGbd_793b80455e0891bd2020-10-16 · +4dVerified
Maine State AGbd_c249343bcb91747d2020-10-16 · +4dVerified

Show 6 more filings ↓up to 410d gap

Indiana State AGbd_3e8eae6632241b152020-10-13 · +7dVerified
California State AGbd_d87c41df3edad4b32020-10-13 · +7dVerified
Delaware State AGbd_f98a16396915c9b32020-10-13 · +7dVerified
California State AGbd_1c52d20f405628ca2021-02-04 · +107dVerified
Illinois State AGbd_e101d74749d2c0772020-01-01 · +293dCandidate
Delaware State AGbd_1c3ab84ff5393d162021-12-04 · +410dVerified

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com
Industry: Retail & ConsumerllmHospitalityllm

Discovered: Aug 15, 2020
Breach occurred: Aug 1, 2020
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 5,801state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External
Regulator citations: Notified appropriate regulators
Initial access: exploit_public_facing

During the incident: Shut down the intrusion
Restored operations
Engaged a major cybersecurity firm to investigate
Notified law enforcement and appropriate regulators
Issued a news release
Posted website notices
Established a dedicated call center
Offered complimentary credit monitoring
Changes made: Reviewing security and privacy policies and procedures
Implementing changes to enhance information security and privacy controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(66 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 9 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+286d

California State AG+286d

Delaware State AG+286d

Oregon State AG+289d

Maine State AG+289d

Massachusetts State AG+291d

New Hampshire State AG+293d

South Carolina State AG+293d · this page

California State AG+400d

Delaware State AG+703d

Pattern: first filing Jan 1 (IL), last Dec 4 (DE) — a 703-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/CarnivalCorpOctober.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 20, 2020
Raw hash: 5db396b6b6666c74c154234a8475d3f007b05537af93c74698f4bd0c310ae3c8

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityCarnival Corporation Ltd.

Victim entityCarnival Corporation Ltd.

Incidentdiscovered Aug 15, 2020

Stated responseShut down the intrusion

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov