Among them were 507 Nebraskans, according to Nebraska Attorney General Doug Peterson.
In a news release, he said Carnival publicly reported the data breach in March 2020, about 10 months after the company first became aware of suspicious email activity.
A multistate investigation by attorneys general followed, focusing on Carnival's email security practices and compliance with state breach notification statutes.
Peterson said the breach included names, addresses, passport numbers, driver's license numbers, payment card information, health information and a relatively small number of Social Security numbers.
Under the settlement, Carnival has agreed to a series of provisions designed to strengthen its email security and breach response practices going forward.
© 2022 Lincoln Journal Star, Neb. Distributed by Tribune Content Agency, LLC.