Carnival, which like the rest of the travel industry has been stricken by the Covid-19 pandemic it also operates Princess Cruises, owner of the ill-fated Diamond Princess, which found itself at the centre of the initial outbreak reported the incident to the US Securities and Exchange Commission on 17 August.
Promptly upon its detection of the security event, the company launched an investigation and notified law enforcement, and engaged legal counsel and other incident response professionals, said Carnival.
While the investigation of the incident is ongoing, the company has implemented a series of containment and remediation measures to address this situation and reinforce the security of its IT systems. The company is working with industry-leading cyber security firms to immediately respond to the threat, defend the companys IT systems, and conduct remediation.
Carnival said that based on its preliminary assessment, and on the information currently known, the incident will not materially affect its business, operations or financial results.
Carnival is the worlds biggest cruise operator it employs more than 150,000 staff and in more auspicious times welcomes 13 million people on board its ships every year. Besides Carnival Cruise Line and Princess Cruises, it also runs the Costa, P&O Australia, P&O Cruises, Holland American Line, AIDA, Cunard and Seabourn brands.
Dan Panesar, UK and Ireland director at Securonix, a specialist in security information and event management , said that with the theft of personal data, the Carnival incident looked set to prove a particularly nasty one.
It appears the attackers have used the classic diversion of a ransomware attack to divert attention from the real focus of the attack, which was to steal valuable and sensitive data, he said.
There's been a surge of movement to the cloud in recent years, but there are still some benefits to an on-site database.