Norwegian Cruise Line Holdings Ltd. data breach (2024–2026)

Identity resolution

Canonical name: Norwegian Cruise Line Holdings Ltd.
Normalized: norwegian cruise line— dedupe via name-norm; Microsoft / MSFT collapse to one row
GLEIF LEI: No match
SEC EDGAR CIK: None — not an SEC registrant
Domain: None on record

Disclosure history (2)newest first

FEDERALSEC 10-K Item 1Cas victim2026-03-02
Norwegian Cruise Line Holdings Ltd. (NCLH) filed its 10-K Item 1C disclosing no known cybersecurity threats that have materially affected or are reasonably likely to materially affect its business, strategy, results of operations, or financial condition. The company describes its cybersecurity governance, including a dedicated SOC, board oversight, and third-party risk management, but confirms no material incidents occurred.
FEDERALSEC 10-K Item 1Cas victim2024-02-28
10-K Item 1C cybersecurity disclosure from Norwegian Cruise Line Holdings Ltd. The filing describes a cybersecurity risk management program, including a Security Operations Center, third-party vendor controls, PCI compliance efforts, NIST/ISO benchmarking, and board-level oversight via the TESS Committee. The company states no cybersecurity incidents have materially affected its business and any prior expenses were immaterial. No specific breach is disclosed.

Subsidiary disclosures (1)filed by group companies

◈ These filings were made by or about subsidiaries of Norwegian Cruise Line Holdings Ltd. — not by Norwegian Cruise Line Holdings Ltd. itself. Corporate relationships are mapped from GLEIF relationship records and SEC Exhibit 21 filings.

Tracked subsidiaries✦ NCL CORP Ltd.

FEDERALSEC 10-K Item 1Cvia NCL CORP Ltd.2024-02-28
Norwegian Cruise Line Holdings Ltd. Item 1C cybersecurity disclosure in its Annual Report describes its cybersecurity risk management program, internal Security Operations Center, third-party service-provider oversight, PCI compliance efforts, and Board/TESS Committee governance. The filer states it is not aware of any cybersecurity threats or prior incidents that have materially affected or are reasonably likely to materially affect its business; expenses from cybersecurity incidents were immaterial. No specific breach is disclosed.