The Norwegian cruise and ferry company "Hurtigruten" announced that it was hit by a major data cyberattack on Monday. The hackers behind the attack aimed to take control of the company’s data and then demand ransom in order to restore it.
The company's chief digital officer, Ole-Marius Moe-Helgesen, said in a statement: "This is a serious attack. All of Hurtigruten's global digital infrastructure seems to have been affected." Hurtigruten has implemented comprehensive measures to limit the extent of damage from the attack.”
Hurtigruten said that the company is working with the authorities and partners to get an overview, as well as limit the spread and damage of the attack, noting that "the attack seems to be so-called ransomware." Ransomware is a type of malware that encrypts targeted data and the cybercriminals then demand a ransom from the victim to restore access to the database upon payment.
Due to the data attack, Hurtigruten's website is down and the company’s phone lines are currently unavailable.
The cyber-attack on the Norwegian cruise company comes at a time when Hurtigruten, like the rest of the cruise ship industry, is struggling to cope with the global COVID-19 pandemic. In August, the company announced that it was halting so-called expedition and adventure cruises, following the COVID-19 outbreak on one of its ships. At least 40 passengers and crew members of the cruise ship "Roald Amundsen" tested positive for the virus, according to public health officials. However, the company stated at the time that its separate activities in transporting goods and passengers to Norwegian ports would continue.
Norway hit by cyberattacks
Hurtigruten is the latest Norwegian company to be hit by a cyber-attack this year. Just a few months ago the Norwegian parliament was also hit by a cyberattack, as well as the telecommunications giant Telenor.
Two months ago the telecommunications and digital services provider Telenor, reported that the company was hit by a significant cyber-attack with demands for ransom. After this attack, the blackmailers demanded payment for not exposing the company to further attacks. Back then Telenor CEO warned other companies in Norway to be on guard.
“I want to warn that this group is now attacking Norwegian companies. I would especially like to warn companies that do not have effective methods for averting major consequences from denial of service attacks through DDoS protection. The most important thing of all is not to pay the ransom. It will only make this type of attack profitable, and motivate the cybercriminals to continue,” said Telenor CEO Petter-Børre Furberg in the press release.
Hackers gain access to Princess Cruises and Holland America Line data
In March 2020, Carnival Corp. — the parent company of Princess Cruises and Holland America Line released a statement that hackers gained unauthorized access to some employee and passengers accounts between April 11 and July 23, 2019. Those accounts contained the personal data of those who traveled and worked on-board the Princess and Holland America ships, exposing a wide range of data.
“The investigation revealed unauthorized third-party access to certain email accounts containing employee and guest personal information, including names, Social Security numbers, government identification numbers, such as passport numbers, national identity card numbers, credit card and financial account information, and health-related information.” the company said.
Carnival Corp. filed a data security notice with the California Attorney General, indicating that at least 500 California residents were involved in the case, as this is the minimum number of people needed to trigger a mandatory filing.
Back then Breach Clarity, the tech company focusing on response plans for data breaches, rated both the Princess and Holland America breaches a ‘seven’ risk level out of ten.
Fraudsters targeting crew members
This year we have seen many scams targeting cruise ship employees including fake websites claiming bonuses, emails, and fake letters. Many crew members have been targeted by fake websites that look very similar to the official ones claiming there is a $200 Bonus and asking the victims to reveal their personal information including bank accounts. Some of the messages crew members received was the “Bonus Reward Salary at Sea” by a fake Brightwell website.
Brightwell shared the scam on their Facebook page saying that the fake websites use similar domain names to lure targeted crew members.
“We are always keeping an eye out for the safety and security of our crew members. Fraudsters have recently been targeting our crew members by setting up phishing websites that look very similar to our Brightwell Navigator website. Remember, only trust brightwellnavigator.com and the Brightwell Navigator mobile app.
Royal Caribbean President Michael Bayley took to social media to warn the crew not to fall for an email scam targeting their private information and not to click the links.
