COLORADO SPRINGS — A cruise-based travel agency, will pay more than $24,700 to the state of Colorado in a $1.25 million multistate settlement after a 2019 data breach compromised the personal information of 3,037 Colorado residents.

Attorney General Phil Weiser announced that Carnival also agreed to implement additional data security safeguards to protect consumers’ information in the future.

“Businesses need to be vigilant to protect the personal information of their customers and employees from the actions of hackers and others intent on stealing that information,” Weiser said.

In late May 2019, Carnival learned that an employee email address was used to spam other company email accounts. In an apparent business email compromise attack, the intruders compromised 124 Carnival employee email accounts. Ten months later, Carnival provided notice to more than 100,000 consumers nationwide whose personal information was found in the compromised email accounts, including more than 3,000 Colorado residents.

In a settlement, Carnival agreed to implement several specific data security safeguards, including a comprehensive information security program and incident response and data breach notification plan to provide additional protections for consumers.

The settlement funds will be used for reimbursement of the state’s actual costs and attorneys’ fees, the payment of restitution, if any, and for future consumer fraud or antitrust enforcement, consumer education, or public welfare purposes.

Colorado joined a coalition of 45 states and the District of Columbia in this settlement. Colorado law requires certain persons and entities to take reasonable steps to protect personal identifying information and dispose of this information when it is no longer necessary to keep it.

Consumers who believe their personal information may have been compromised and their identity stolen, view Stop Fraud Colorado’s identity theft repair kit here.