HackingRetail & ConsumerRetailStolen CredentialsPhishingCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PIIMediumContained

Carnival Corporation Ltd.

bd_e54ff2b7a469347a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 19, 2021

Filed

May 21, 2021

To disclose

9 weeks

Affected

44state residents only

Linked

6 filings

Confidence

63%

Full breach record for Carnival Corporation Ltd. →14 incidents on file

Carnival Corporation & PLC notified Montana residents of a March 2021 cyber event where unauthorized third-party access to email accounts compromised personal information including names, addresses, passport numbers, DOBs, health info, and SSNs. Access detected March 19, 2021. Company engaged cybersecurity firm, notified regulators, and offered 12 months credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 9 weeks / 63 days

Mar 15, 2021

Begins

Mar 19, 2021

Discovered

May 21, 2021

Filed

vs. sector median

+2 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_c8917be506d4829a2021-10-06 · +138dVerified
Maine State AGbd_b45cbe1068a6d4572021-10-16 · +148dVerified
California State AGbd_1e5e7014d602908c2021-10-18 · +150dVerified by operator
Oregon State AGbd_df459e2ce7c7cf542021-10-18 · +150dVerified

Show 1 more filing ↓up to 217d gap

Oregon State AGbd_793b80455e0891bd2020-10-16 · +217dVerified

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com

Name: Carnival Corporation Ltd.
norm: carnival
Domain: carnivalcorp.com
Industry: Retail & Consumerllm

Discovered: Mar 19, 2021
Breach occurred: Mar 15, 2021 – Mar 19, 2021
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 7, 2021
Affected individuals: 44state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified appropriate regulators
Initial access: valid_credentials

During the incident: Shut down the event and prevent further unauthorized access
Engaged a leading cybersecurity firm to investigate the matter
Notified appropriate regulators
Offering individuals free credit monitoring and identity theft detection services for 12 months
Changes made: Regularly review security and privacy policies and procedures
Implement changes to enhance information security and privacy program and controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Oregon State AGOct 16 · first

Montana State AG+217d · this page

Montana State AG+355d

Maine State AG+365d

California State AG+367d

Oregon State AG+367d

Pattern: first filing Oct 16 (OR), last Oct 18 (OR) — a 367-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Carnival-notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 21, 2021
Raw hash: 0609875b27e10ff93e4edb22f137222b8a02353afe2d050b1c8f878e54791a3d

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCarnival Corporation Ltd.

Victim entityCarnival Corporation Ltd.

Incidentdiscovered Mar 19, 2021

Stated responseShut down the event and prevent further unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov