LANSING, Mich. (WLNS) — Attorney General Dana Nessel joined 45 attorneys general on securing a $1.25 million multi-state settlement with Carnival Cruise Lines.

The settlement comes from a 2019 data breach that involved around 180,000 Carnival employees and customers nationwide.

Michigan will receive $29,016.47 from the settlement, and 3,817 Michiganders were impacted by the breach.

Carnival publicly reported the data breach in March 2020, which an unauthorized actor gained access to certain Carnival employee e-mail accounts.

The breach included names, addresses, passport numbers, driver’s license numbers, payment card information, health information and even some Social Security Numbers.

Carnival was aware of the breach as of May 2019, around 10 months before the breach was reported.

“I’m proud to join my colleagues in securing more than a million dollars from Carnival related to this data breach,” Nessel said. “Just as important are the new policies Carnival agreed to, which will better protect their employees’ and customers’ personal information. We must ensure large companies and corporations prioritize data security just as they would profits.” 

Under the settlement, Carnival has agreed to a the following provisions:

  • implementation and maintenance of a breach response and notification plan;
  • email security training requirements for employees, including dedicated phishing exercises;
  • multi-factor authentication for remote email access;
  • password policies and procedures requiring the use of strong, complex passwords, password rotation, and secure password storage;
  • maintenance of enhanced behavior analytics tools to log and monitor potential security events on the company’s network; and
  • consistent with past data breach settlements, undergoing an independent information security assessment. 

The other attorneys general to join include Alaska, Colorado, Delaware, the District of Columbia, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Dakota, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, West Virginia, Wisconsin, and Wyoming.