Viking Line Data Breach Exposes Passenger Information via Third-Party API

Viking Line has confirmed a data breach involving a threat actor known as 'bytetobreach', who claims to have accessed sensitive passenger data through the NetAxept API. The leaked information includes details on advance bookings, personal information, vehicle registration plates, and payment transaction records. Although Viking Line describes the leaked information as limited, they acknowledged that certain traveler data was indeed exposed. The company is currently investigating the incident with both internal teams and external experts, assuring that core booking systems and ongoing operations remain unaffected. The breach highlights vulnerabilities associated with third-party suppliers and their APIs. No specific numbers of affected individuals have been disclosed, and the investigation is ongoing. The threat actor has made samples of the data available for free download on dark web forums.

Key Points: • Viking Line's data breach involves sensitive passenger information accessed via a third-party API. • The threat actor 'bytetobreach' claims responsibility and has shared samples of the data online. • Viking Line is investigating the breach but reports that core operations remain unaffected.