Carnival Cruise Line Hit With Ransomware Attack: Guest, Employee, and Crew Info Exposed
Table of Contents
- By Dawna M. Roberts
- Published: Oct 16, 2020
- Last Updated: Mar 18, 2022
In August, cybercriminals hacked into Carnival Cruise Line's system and gained access to guest, crew, and employee data for three brands: Carnival Cruise Line, Holland America Line, and Seabourn.
In a statement, Carnival commented that "a low likelihood of the data being misused." In a statement released on August 15, Carnival Cruise spokesperson said that they "detected a ransomware attack that accessed and encrypted a portion of one brand's information technology systems. The unauthorized access also included the download of certain of our data files." Carnival IT personnel immediately contact police when they discovered the attack and "implemented a series of containment and remediation measures to address this situation and reinforce the security."
Terence Jackson, Chief Information Security Officer at Thycotic, cautioned, "While how the third party gained unauthorized access has not been disclosed, this is yet another example of the importance of proper investment in cybersecurity programs to protect company and customer data." He went on to say, "Attackers are not taking it easy during the pandemic. They are stepping the attacks up, and we have to be ready."
The attack on Carnival Cruise is another in a long list of recent attacks on major brands like Jack Daniels, Canon, Garmin, Konica Minolta, and Brown-Forman.
These latest exploitations use the double-extortion attempt where criminals first gain access to the information, then demand a ransom. If the ransom is not paid, they publicly release the data, exposing victims to identity theft, fraud, and other scams.
New Malware Model Ransomware-as-a-Service
Thycotic's Jackson said that early versions of ransomware were sophisticated software programs, but as they evolve, he has witnessed a shift to a more simplified ransomware-as-a-service model. This model makes it easier to deploy and is responsible for the increase in attacks.
The Cost of Ransomware
Companies hit hard by ransomware attacks are experiencing a double-whammy in terms of financial loss. First, they must decide whether or not to pay the ransom, and if they do, it could mean a substantial fee to get their data back. The next step for them is going to be to implement much better security systems to avoid future attacks. The financial strain of this double-hit could cripple some organizations with a blow they cannot recover from.
As more companies pay the ransom, it spurs cyber thieves onto to commit further to their efforts. Managing Director of the Information Security Forum, Steve Durbin commented that "Ransomware attackers are not interested in stealing assets and using them to cause damage, but in exploiting the value of the asset to its owner. When striking at organizations, attackers will target systems that are fundamental to business operations, some of which may be operating in an unprotected manner or which may have been unwittingly exposed during the COVID-19 response when workers were forced to access corporate systems from home."
In the Carnival attack, hackers targeted systems that housed employee, crew, and guest data. Carnival has been struggling since April after reports of 1,500 guests contracting COVID-19 on cruises and quite a few dying.
Unfortunately, with so many data breaches occurring, the pile of valid credentials available on the dark web is unfathomable and ultimately responsible for many of these new attacks. Cyber experts also cite successful phishing campaigns as the number one way hackers install malware and execute ransomware attacks.
Other vulnerable areas that cyber gangs export are supply chains, vendor loopholes, and credential stuffing. Pravin Madhani, CEO of K2 Cyber Security, warns that companies "need to make sure they vet the security of partners as thoroughly as they vet their own security infrastructure." He also suggests that employee and management training needs to be at the top of the list to prevent ransomware attacks and promote best practices.
How to Protect Your Business
Durbin, urges companies to rethink their security measures, especially now with staff working from home. He elaborates with "Established plans that depend on employees being able to work from home, for example, do not stand up to an attack that removes connectivity or personally targets individuals as a means of dropping ransomware into the corporate infrastructure. Revised plans should cover threats to periods of operational downtime caused by attacks. Creating a cyber-savvy workforce that takes information security seriously, while nurturing a culture of trust, will help to eliminate poor security practices as well as diminish the number and scale of incidents."
Caroline Thompson, Head Underwriter at Cowbell Cyber, suggests organizations invest in cyber insurance to protect themselves against these types of attacks and the financial and repetitional impacts. She noted that "Business interruption, loss of revenue, and reputational damages are all financial burdens that cyber insurance can provide relief for."
