ATLANTA – The State of Georgia has obtained a multistate settlement with Carnival Cruise Line involving a breach in data.

Release:

Attorney General Chris Carr announced that the State of Georgia, along with 45 other attorneys general, has obtained a $1.25 million multistate settlement with Florida-based Carnival Cruise Line stemming from a 2019 data breach that involved the personal information of approximately 180,000 Carnival employees and customers nationwide. Georgia is positioned to receive $29,399.10 from the settlement.

“With bad actors consistently looking for new ways to steal personally identifiable information, it is critical that businesses institute strict protocols to help ensure customer data is kept safe,” said Carr. “This includes properly alerting consumers of a data breach so they can take immediate action to guard against identity theft. Cybersecurity remains one of our top priorities, and we will continue working with our public and private sector partners to protect the personal and financial information of our fellow Georgians.”

In March 2020, Carnival publicly reported a data breach in which an unauthorized actor gained access to certain Carnival employee e-mail accounts. The breach included names, addresses, passport numbers, driver’s license numbers, payment card information, health information and a relatively small number of Social Security Numbers. In total, 3,887 Georgians were impacted.

Breach notifications sent to attorneys general offices stated that Carnival first became aware of suspicious email activity in late May of 2019 – approximately 10 months before Carnival reported the breach. A multistate investigation ensued, focused specifically on Carnival’s email security practices and compliance with state breach notification statutes.

“Unstructured” data breaches like the Carnival breach involve personal information stored via email and other disorganized platforms. Businesses lack visibility into this data, making breach notification all the more challenging – and consumer risk rises with delays.

Under the settlement, Carnival has agreed to a series of provisions designed to strengthen its email security and breach response practices moving forward. The provisions include:

• Implementation and maintenance of a breach response and notification plan;
• Email security training requirements for employees, including dedicated phishing exercises;
• Multi-factor authentication for remote email access;
• Password policies and procedures requiring the use of strong and complex passwords, password rotation, and secure password storage;
• Maintenance of enhanced behavior analytics tools to log and monitor potential security events on the company’s network; and
• Consistent with past data breach settlements, undergoing an independent information security assessment.

In addition to Georgia, the following states also joined the settlement: Alabama, Alaska, Arizona, Arkansas, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin and Wyoming.

Cybersecurity Guide

The Attorney General’s Consumer Protection Division offers Cybersecurity in Georgia: A Guide for Small Businesses, Non-Profits and Places of Worship. This guide highlights common industry best practices, including ways to protect your data and network, training employees about cybersecurity, planning for and responding to a security breach, and more.

Download the guide here or call the Consumer Protection Division at (404) 651-8600 to request your free hard copy.