Carnival Corporation, the largest cruise line operator in the world, has suffered a ransomware attack in which customer data is believed to have been compromised. The company is unaware how many people may have been affected by the incident, which was detected on Saturday, August 15.
Carnival boasts over 100 vessels operating under its ten different brands, including the popular Carnival Cruise Line, Princess Cruises, Costa Cruises, P&O, and Cunard Line. It has notified the US Securities and Exchange Commission (SEC) of the attack, revealing that hackers accessed a portion of one of its brand’s IT systems. It added that the perpetrators were able to download “certain of our data files,” and likely compromised the “personal data of guests and employees.”
“Promptly upon its detection of the security event, the company launched an investigation and notified law enforcement and engaged legal counsel and other incident-response professionals,” Carnival said.
The company said it is working with “industry-leading” cybersecurity firms to deal with the situation and beef up its systems. While just one unnamed brand was targeted, Carnival said it could not guarantee that other brands were not affected.
The attack couldn’t have come at a worse time for Carnival. The cruise industry is one of many to have been devastated by Covid-19, with canceled voyages, disruptions, and delays to ship deliveries. It’s already resulted in Spanish cruise operator Pullmantur Cruises, which is partly owned by Royal Caribbean Cruises, shutting down.
Carnival reported a loss of $4.4 billion in the second quarter compared to an income of $451 million during the same period a year earlier. Total passenger numbers for the year to date were 426,000 compared to 3.1 million in 2019.
Carnival is trying to reassure investors. “Based on its preliminary assessment and on the information currently known (in particular, that the incident occurred in a portion of a brand’s information technology systems), the company does not believe the incident will have a material impact on its business, operations or financial results,” it said. The company’s stock price reached $50 per share in January before tanking to a low of around $8 in April. It’s currently at $14.41.
Several large organizations have been victims of ransomware attacks recently. Operators stole “10 terabytes of data, private databases, etc.” from Canon earlier this month, 2.2GB of which has been published online, suggesting the company is refusing to pay. Garmin was also hit back in July, which resulted in major disruption to its online services and production. The wearables giant reportedly paid a multi-million dollar ransom to recover its data.