The Personal Information of 800,000 Texas Residents Is Hacked In A Carnival Cruiseline Data Breach

Another day, another hack of Texans' personal information. This time it involves Carnival Cruise Lines.

Carnival Corporation Investigation

Texas Attorney General Ken Paxton says he is launching a formal investigation into Carnival Corporation following a springtime cybersecurity failure. The April data breach compromised the private records of approximately six million people globally, which included 800,000 Texas residents.

A Huge Hack

Unlike the hack I told you about yesterday involving hunting and fishing licenses in Texas, the cruise line hack involves much more sensitive information. Since Carnival operates on an international basis, it encompasses many travel brands which gather loads of customer information via online profiles.

The Information That Was Hacked

According to state investigators, the following data was stolen in the Carnival hack:

Full names and standard contact details

Dates of birth and medical information

Transactional payment credentials

Passport numbers and state driver's licenses

Smartphone content accessed via app permissions (including camera rolls and device contact lists)

How the Hack Happened

According to Carnival, the company's internal IT defense teams traced the initial breach to a social engineering attack, which is a deceptive tactic used to trick individuals into revealing access credentials. The hack involved only one employee account. Once inside, the unauthorized actors gained access to a restricted section of the company's network.

The Timing of the Hack Reveal

The Attorney General's office is looking into this matter because of the timing of the hack reveal. 800,060 Texans had their profiles compromised, but the data breach notification arrived 44 days after the hack, which raises questions about why it took so long to let people know that their information had been compromised. The state has issued a Civil Investigative Demand (CID) to determine if Carnival's defensive protocols met the legal benchmarks required by regional consumer protection acts.