COLUMBIA, S.C. (WCBD) – South Carolina has joined a multi-state settlement over a Carnival Cruise Line data breach that happened in 2019.
Attorney General Alan Wilson announced on Wednesday the $1.25 million settlement, between 45 other states, stems from a 2019 data breach that involved the personal information of about 180,000 Carnival employees and customers nationwide.
Carnival Cruise Line announced in March 2020 that an unauthorized person gained access to certain Carnival employee e-mail accounts. AG Wilson said the breach included names, addresses, passport numbers, driver’s license numbers, payment card information, health information, and a relatively small number of Social Security Numbers.
2,259 South Carolinians were impacted, and they have been notified.
“What happened in this case is a reminder that it could happen to any other business, so it’s important for businesses to take preventive measures to protect the private information of their customers,” Attorney General Wilson said. “They also need to follow regulations about notifying consumers promptly when there is a breach of private information.”
South Carolina will receive $20,500.21 from the settlement.
Under the settlement, Carnival has agreed to a series of provisions designed to strengthen its email security and breach response practices going forward. Those include:
• Implementation and maintenance of a breach response and notification plan;
• Email security training requirements for employees, including dedicated phishing exercises;
• Multi-factor authentication for remote email access;
• Password policies and procedures requiring the use of strong, complex passwords, password rotation, and secure password storage;
• Maintenance of enhanced behavior analytics tools to log and monitor potential security events on the company’s network; and
• Consistent with past data breach settlements, undergoing an independent information security assessment.
Connecticut, Florida, and Washington co-led the investigation, assisted by Alabama, Arizona, Arkansas, Ohio, and North Carolina, and joined by Alaska, Colorado, Delaware, the District of Columbia, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Dakota, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, West Virginia, Wisconsin, and Wyoming.