Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
Carnival Corporation is the world’s largest cruise ship operator, and another large company that discloses the fact that it was affected by a data breach. It looks like the Carnival Cruise data breach happened after the attackers managed to gain access to some of its IT systems that were containing personal, financial, and health information belonging to customers, employees, and crew.
Carnival is operating nine of the world’s leading cruise line brands (Carnival Cruise Line, Costa, P&O Australia, P&O Cruises, Princess Cruises, Holland American Line, AIDA, Cunard, and Seabourn) and a travel tour company (Holland America Princess Alaska Tours), and is included in both S&P 500 and FTSE 100 stock market indices, having over 150,000 employees in 150 countries, and providing leisure travel to more than 13 million guests each year.
According to the statement provided by Carnival, unauthorized third-party access to a limited number of email accounts was detected on March 19, 2021.
It appears that in mid-March, the unauthorized third party gained access to certain personal information relating to some of our guests, employees, and crew.
The impacted information includes data routinely collected during the guest experience and travel booking process or through the course of employment or providing services to the Company, including COVID or other safety testing.
Carnival disclosed that in the accessed information can be found the names, addresses, phone numbers, passport numbers, dates of birth, health information, and, in some limited instances, additional personal information like Social Security or national identification numbers, therefore the cruise line operator warned all impacted customers, employees, and Carnival Cruise Line, Holland America Line, Princess Cruises, and medical operations crew in regards to the data breach.
Not the First Cybersecurity Incident for Carnival
Just last year, a ransomware attack hit Carnival, the incident being confirmed by the cruise line operator in an 8-K form filed with the US Securities and Exchange Commission (SEC).
Only two months after this incident took place the company declared in a separate SEC filed that the ransomware gang behind the August attack gained access to the personal information of both customers and employees during the attack, leaving roughly 37,500 individuals affected by this ransomware attack, according to info filed by Carnival with the Office of Maine’s Attorney General.
This specific attack came after a data breach disclosed in March 2020 also leading to the exposure of customers’ personal and financial information after threat actors gained access to Carnival employees’ email accounts.
Heimdal™ Ransomware Encryption Protection
- Blocks any unauthorized encryption attempts;
- Detects ransomware regardless of signature;
- Universal compatibility with any cybersecurity solution;
- Full audit trail with stunning graphics;
Another attack took aimed at Carnival took place in December 2020 when the company was hit by a second ransomware attack with “investigation and remediation phases” still ongoing, according to a 10-Q form filed with the SEC in April 2021.
There is currently no indication of any misuse of information potentially accessed or acquired and we continue to work with regulators to bring these matters and other reportable incidents to conclusion.
Dora is a digital marketing specialist within Heimdal™ Security. She is a content creator at heart - always curious about technology and passionate about finding out everything there is to know about cybersecurity.
