Carnival, which operates AIDA, Carnival and Princess cruises among others, outlined the cybersecurity incident in a regulatory filing (to the U.S. Securities and Exchange Commission on August 17, 2020). The major fleet operator said the attack included unauthorized access to personal data of guests and employees. However, the company has yet to detail the brand that has been affected. When probed, the company has declined to provide more details at this time.
Looking into the matter for Digital Journal is Anurag Kahol, CTO and co-founder of Bitglass.
According to Kahol, it’s no surprise that a cruise ship operator has hot by a cyberattack: “The travel industry is an attractive target to cybercriminals.” The details collected by travel firms offer an opportunity for criminals to “collect and store personally identifiable information on billions of passengers every year.” Such traceable data covers passport numbers, credit card details, and email addresses.”
Kahol says there is a comminality with such attacks: “The attackers accessed and encrypted a portion of one brand’s information technology systems”, plus “the intruders also downloaded files from the company’s network.” These are common tactics in relation to this kind of attack.
There are measures that firms can take to off-set the impact of such attacks, Kahol explains: “To thwart ransomware attacks and mitigate their impact, organizations need advanced threat protection.” This is by implementing “security solutions that can identify and remediate both known and zero-day threats on any cloud application or service, and protect managed and unmanaged devices that access corporate resources and data.”
Measures also include solutions that can automatically block malware, according to Kahol: “In the cloud that is both at rest or in transit. Additionally, organizations must ensure adequate employee security training to identify phishing attempts and illegitimate emails as phishing is the primary vector for ransomware attacks.”
