Post‑Breach Compliance Roadmap for Carnival after the ShinyHunters Incident

1. GDPR (EU General Data Protection Regulation) – Effective 25 May 2018

What it requires

• Breach notification to the relevant supervisory authority within 72 hours of becoming aware of the incident, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.
• Direct communication to affected EU residents when the breach is likely to result in a high risk (e.g., exposure of national ID numbers or dates of birth).
• Data protection impact assessment (DPIA) updates to reflect the new risk profile and to document remedial measures.
• Record‑keeping of the breach in the internal log of processing activities (Article 30).

Compliance timeline

Deadline	Action
Within 72 hours of detection (mid‑April 2026)	Submit notification to the Irish Data Protection Commission (DPC) – Carnival’s EU lead regulator – and prepare a draft notification for EU data subjects.
By 30 days after notification	Publish a detailed breach notice on Carnival’s public website and send individualized emails to the estimated 6 million EU customers.
Within 30 days of notification	Complete the DPIA amendment and obtain sign‑off from the EU Data Protection Officer (DPO).
Ongoing	Update the processing‑activities register and retain breach documentation for at least 5 years as required by Article 5(1)(e).

---

2. CCPA / CPRA (California Consumer Privacy Act / California Privacy Rights Act) – Effective 1 Jan 2020 (CPRA amendments effective 1 Jan 2023)

What it requires

• Notice‑at‑collection updates to disclose the categories of personal information now known to be compromised (including state ID numbers).
• Consumer rights fulfillment: Provide affected California residents with the right to delete their data, opt‑out of future sale, and receive a copy of the compromised records.
• Free credit‑monitoring must be offered for at least 12 months (the company already provides two years, which exceeds the minimum).
• Annual compliance certification with the California Attorney General’s office, documenting breach response actions.

Compliance timeline

Deadline	Action
Within 30 days of breach discovery	Update privacy notices on the Carnival website and mobile apps to reflect the breach.
Within 45 days	Publish a “Do Not Sell My Personal Information” reminder and provide a clear opt‑out mechanism for all California users.
Within 60 days	Deliver the free credit‑monitoring enrollment instructions to each affected Californian and confirm receipt.
Within 90 days	Submit the required compliance certification to the California AG, including a summary of remediation steps taken.

---

3. NYDFS Cybersecurity Regulation (23 NYCRR 500) – Effective 21 March 2017, with revisions in 2022 and 2024

What it requires

• Incident reporting to the NY Department of Financial Services within 72 hours of a breach that impacts NY‑based customers or systems.
• Comprehensive risk assessment covering the phishing vector, credential harvesting, and any lateral movement into cloud services.
• Multifactor authentication (MFA) must be enforced for all privileged accounts and remote access pathways.
• Annual penetration testing and quarterly vulnerability scans must be documented and any critical findings remediated within 30 days.

Compliance timeline

Deadline	Action
Within 72 hours of detection	File the NYDFS breach report (Form NYDFS‑500) describing the incident, affected records, and immediate containment steps.
Within 30 days	Conduct a full NYDFS‑required cyber‑risk assessment, focusing on phishing‑resilience controls, and submit the written report to the regulator.
Within 45 days	Deploy MFA across all privileged and remote‑access accounts if not already in place; document the rollout plan.
Within 90 days	Complete the first quarterly vulnerability scan and remediate any findings classified as “high” or “critical.”
By 31 December 2026	Submit the annual compliance certification covering the entire 2026 calendar year.

---

4. FTC Safeguards Rule (under the Gramm‑Leach‑Bliley Act) – Effective 21 Dec 2003, with updates 2021‑2023

What it requires

• Written information security program (WISP) that addresses the specific threats identified in the breach (social‑engineering, credential theft, cloud mis‑configuration).
• Employee training on phishing detection and reporting, to be conducted at least annually and after any major incident.
• Oversight of service providers: Obtain written assurances that any third‑party cloud or SaaS providers implement comparable security controls.

Compliance timeline

Deadline	Action
Within 60 days	Update the WISP to incorporate lessons learned from the ShinyHunters attack, including new phishing‑simulation protocols.
Within 90 days	Roll out mandatory phishing‑awareness training to all 12 000+ Carnival employees worldwide; track completion rates and retain records for 5 years.
Within 120 days	Conduct a third‑party risk assessment of all cloud vendors and obtain updated SOC 2 Type II reports where gaps are identified.
Ongoing	Perform annual WISP reviews and submit a summary of compliance activities to the FTC upon request.

---

5. PCI DSS (Payment Card Industry Data Security Standard) – Version 4.0, effective 1 Mar 2022

Although the breach did not involve payment‑card data, PCI‑compliant merchants must still verify that no cardholder information was exposed and that the incident does not affect the scope of their PCI environment.

What it requires

• Scope validation: Confirm that the compromised systems were outside the Cardholder Data Environment (CDE). If any CDE assets were touched, a PCI‑forensic investigation must be initiated.
• Segmentation review: Ensure network segmentation remains effective to prevent future cross‑zone contamination.

Compliance timeline

Deadline	Action
Within 30 days	Perform a PCI‑scope assessment and document the findings in the annual Self‑Assessment Questionnaire (SAQ).
If CDE impact is discovered	Engage an Approved Scanning Vendor (ASV) for a forensic scan and submit the Report on Compliance (ROC) within 90 days.

---

6. Practical next steps for Carnival’s compliance team

1. Establish a breach‑response task force that includes legal, IT security, privacy, and communications leads. Assign a single point of contact for each regulator.
2. Create a master breach‑notification calendar that tracks the 72‑hour, 30‑day, 45‑day, and 90‑day deadlines across jurisdictions.
3. Document all remedial actions (MFA rollout, WISP update, vendor attestations) in a centralized compliance repository to simplify future audits.
4. Engage an external privacy law firm experienced with GDPR and CCPA to review the public notices before they are released.
5. Run a tabletop exercise within the next 60 days to test the updated incident‑response playbook against a simulated phishing attack.

---

The featured image illustrates the scale of data exposed in the Carnival breach and underscores the urgency of meeting regulatory obligations.

---

Bottom line: The ShinyHunters breach activates a multi‑jurisdictional compliance cascade. By adhering to the specific timelines outlined above, Carnival can demonstrate good‑faith effort, reduce the risk of regulatory fines, and restore confidence among its global customer base.