Carnival Corporation has disclosed that passenger and employee data from three different cruise lines was accessed in a ransomware attack that took place in August.

On August 15, the British-American cruise operator discovered that an unauthorized third party had compromised its computer system and downloaded data files.

An update issued by the corporation yesterday states that personal data from passengers of Carnival Cruise Line, Holland America Line, and Seabourn was impacted in the August attack. 

“While the investigation is ongoing, early indications are that in early August the unauthorized third party gained access to certain personal information relating to some guests, employees and crew for three of the corporation’s brands—Carnival Cruise Line, Holland America Line and Seabourn, as well as casino operations,” said Carnival.

Information accessed by the threat actor may include names, addresses, phone numbers, passport numbers, and dates of birth.

Carnival said: “The investigation into the specific data impacted is ongoing, but in some limited instances, we anticipate additional information impacted may include data such as Social Security numbers, health information, or other personal information.”

Carnival, with over 150,000 employees, is the largest cruise operator in the world, serving over 13 million passengers annually before the outbreak of COVID-19. 

In the disclosure, Carnival stated that it is working “as quickly as possible” to identify and notify the passengers, employees, crew, and other individuals whose personal data may have been accessed. Working out precisely whose data was impacted could take up to 60 days to complete. 

Following the attack, Carnival said it took steps to recover the files being held ransom by the threat actors. The corporation’s investigation into the incident is ongoing, but Carnival said early indicators suggest that the likelihood that the data accessed without authorization has since been misused was “low.” 

“While how the third party gained unauthorized access has not been disclosed, this is yet another example of the importance of proper investment in cyber security programs to protect company and customer data,” commented Terence Jackson, CISO at Thycotic.

“Attackers are not taking it easy during the pandemic. They are stepping the attacks up and we have to be ready.”

A British man who hacked into webcams and CCTV so he could spy on people in their own homes and while on holiday has received a suspended prison sentence.

John Wood’s voyeuristic crimes were uncovered in 2018 as part of a joint investigation by British police and the Federal Bureau of Investigation (FBI) in the United States into the creator of LuminosityLink malware, Colton Grubbs.

The off-the-shelf malware could be secretly deployed on a computer with a Windows OS to hack into the device’s webcam and broadcast footage back to the attacker. Threat actors could also use LuminosityLink to record keystrokes and entrap an infected computer into a botnet.

In 2018, Kentucky resident Grubbs admitted designing and selling LuminosityLink software to over 6,000 customers at $39.99 apiece, despite knowing that many of his customers were using it to spy on victims without their consent. 

Wood, of Minety near Swindon, pleaded guilty to two Computer Misuse Act charges and six counts of voyeurism at Swindon Crown Court. The 42-year-old was handed a two-year-suspended prison sentence. His barrister told the court Wood had been diagnosed with mental health difficulties.

According to the Swindon Advertiser, Wood purchased LuminosityLink software in 2015, but the court heard no evidence that he had used it. However, Wood did use a CCTV management product called Blue Iris to hack into webcams and spy on people. 

Between 2011 and 2016, Wood made over 1,400 illicit video recordings, “the majority of which showed people having sex at home,” according to the newspaper. He also set up secret cameras inside and outside his own home in order to covertly film women. 

Wood didn’t ditch his illegal activities when he went on vacation. The court heard that this committed voyeur set up hidden cameras at a holiday cottage and at the Bognor Regis Butlins holiday resort, capturing video of over 167 victims.

Judge Peter Crabtree, while passing sentence, described Wood as having engaged in a “systematic campaign of voyeurism over a period of six years.”

While LuminosityLink’s creator was sentenced to 30 months in prison in the United States and ordered to forfeit 114 Bitcoins worth $725K, Wood was ordered to register as a sex offender, complete 100 hours of community service, and attend a 30-day sex offender rehabilitation program.

The New York State Department of Financial Services (DFS) has called for the regulation of social media giants after finding the cybersecurity protections at Twitter woefully inadequate.

Governor of New York, Andrew Cuomo, asked the DFS to investigate Twitter following the July 15, 2020, hack into the Twitter accounts of several cryptocurrency firms and well-known public figures.

A report on that investigation, released today, found that the global social media platform lacked adequate cybersecurity protections and, at the time of the attack, did not have a chief information security officer in place.

The department found that threat actors gained access to Twitter’s systems simply “by calling Twitter employees and claiming to be from Twitter’s IT department,” then asking for victims’ login credentials. 

Using this unsophisticated attack strategy, the cyber-criminals hijacked the Twitter accounts of politicians, celebrities, and entrepreneurs, including Barack Obama, Kim Kardashian West, Jeff Bezos, Elon Musk, and several cryptocurrency companies regulated by the DFS.

“The Twitter Hack demonstrates the need for strong cybersecurity to curb the potential weaponization of major social media companies,” noted the DFS.

The report recommended that a new cybersecurity regulatory framework be created for giant social media companies. Currently, the cybersecurity policies and programs of such companies are not overseen by a dedicated federal or state regulator that would ensure that their cybersecurity policies and programs adequately address the risks of their digital operating models. 

Superintendent of Financial Services Linda Lacewell said that companies like Facebook, Twitter, and Instagram had been allowed to regulate themselves for long enough. 

“Social media platforms have quickly become the leading source of news and information, yet no regulator has adequate oversight of their cybersecurity,” she said.

“The fact that Twitter was vulnerable to an unsophisticated attack shows that self-regulation is not the answer.”

Lacewell said that poor cybersecurity at immensely influential social media platforms that increasingly dictate what content is newsworthy could potentially allow hackers to interfere with the US presidential election.

Lacewell said: “As we approach an election in fewer than 30 days, we must commit to greater regulatory oversight of large social media companies. The integrity of our elections and markets depends on it.” 

The report recommends that, given their millions of users and tremendous power over news media, social media companies should be “designated as systemically important institutions with prudent regulation to manage heightened cybersecurity risk.”

IT managers at organizations hit by ransomware are nearly three-times as likely to feel “significantly behind” when it comes to understanding cyber-threats.

According to new research from Sophos, organizations “are never the same after being hit by ransomware” and a third (35%) of victims reported that recruiting and retaining skilled IT security professionals was their single biggest challenge when it comes to cybersecurity.

In an email to Infosecurity, Chester Wisniewski, principal research scientist at Sophos, said that falling victim to a cyber-attack has a major impact on attitudes to cybersecurity staffing. “It is likely that there are several factors behind these varying attitudes. Firstly, the consequences of limited security skills are still fresh in the minds of those who have recently suffered the financial, operational and reputational cost of being held to ransom,” he explained.

“In addition, ransomware victims will invariably have investigated the source of the attack. In doing so, they will have identified the gaps in their defenses that enabled the attackers to penetrate their organizations and access their data. Many will likely have identified a shortage of human expertise as a contributing factor to falling victim to attack.”

The survey of 5000 IT decision makers also found that ransomware victims spend proportionally less time on threat prevention (42.6%) and more time on response (27%) compared to those who haven’t been hit (49% and 22% respectively), diverting resources towards dealing with incidents rather than stopping them in the first place.

Asked if this shows there is a requirement for a more proactive stance on security, Wisniewski said: “The difference in resource priorities could indicate that ransomware victims have more incidents to deal with overall. However, it could equally indicate that they are more alert to the complex, multi-stage nature of advanced attacks and therefore put greater resource into detecting and responding to the tell-tale signs that an attack is imminent.”

IT management and security company Ivanti has announced the appointment of Melissa Puls as its new senior vice-president (SVP) and chief marketing officer (CMO).

Puls joins Ivanti after recently serving as SVP and CMO at Avid, and brings decades of experience to the company with a strong track record of fuelling growth through a customer-centric approach and integrating marketing strategies for acquired companies.

Puls will lead Ivanti’s global marketing function to drive expansion and adoption of the company’s enterprise software solutions globally.

“Ivanti is at an exciting and pivotal time in its growth and transformation,” said Puls. “With an impressive portfolio of solutions that improve the security, manageability and serviceability of today’s remote and digital workplace, Ivanti is poised for unprecedented growth. I’m thrilled to be playing such a strategic role in helping Ivanti capitalize on this extraordinary market opportunity.”

Jeff Abbott, president of Ivanti, said that Puls is perfectly-suited to enriching and expanding Ivanti’s marketing footprint as the firm continues to grow.

“Her market insights, go-to-market expertise and deep understanding of the customer engagement journey will play a valued role on the Ivanti executive team as we continue building our market position as both a leader and innovator for the digital enterprise,” he added.

The DVLA reported nearly 200 breach notifications to the data protection regulator over the past year, according to new Freedom of Information (FOI) data.

FOI requests were sent to 17 government departments by secure storage vendor Apricorn, to assess the effectiveness of data security measures in the public sector. Some 14 departments provided responses for the period April 2019 to July 2020.

The DVLA said it submitted 181 breach notifications to the Information Commissioner’s Office (ICO) across 2019-20. By contrast, the Home Office submitted just 25 during the period, while NHS Digital notified the ICO only four times.

“The large number of data incidents being reported may be in part due to the increased awareness and changes in processes when identifying and managing data breaches. The change in requirements in line with the GDPR will of course see a rise in the numbers now being reported to the ICO,” argued Apricorn EMEA managing director, Jon Fielding.

“Needless to say, if the data is secure in the first instance, the number of breaches, and the need to report them, would obviously decline. Public sector bodies should follow the same process as any business would when it comes to mitigating risk. At the very least, data should be encrypted in transit and at rest so that, in the event defenses are compromised, the data remains inaccessible.”

He added that the surge in remote working thanks to the pandemic will also potentially introduce data security concerns if information is not properly protected when flowing out to home endpoints and cloud servers.