Viking Line Confirms Data Breach via Third-Party Supplier Viking Line, a ferry operator, has reported a data breach affecting customer information after a security incident at a third-party subcontractor responsible for pre-order services, including onboard purchases and reservations. The breach was discovered earlier this week. Finnish media outlets, including Yle, Iltalehti, and Hufvudstadsbladet, report that the exposed data includes advance booking details and potentially passenger personal information. The threat actor "bytetobreach" has claimed responsibility on dark web forums, alleging access to a full passenger database including vehicle registration plates and payment transaction records linked to onboard services via the NetAxept API. Samples of the data were reportedly made available for free download. Viking Line has assembled a large internal team, working with external experts, to investigate the incident. While the company described the leaked information as limited, it confirmed that certain traveler data was exposed. Swedish communications chief Eleonora Hult din stated that operations remain unaffected, with no evidence suggesting the breach impacted core booking systems or ongoing voyages.

Viking Line Confirms Data Breach via Third-Party Supplier Viking Line, a ferry operator based in Åland, has disclosed a data breach affecting customer information following a cybersecurity incident at one of its third-party service providers. The breach highlights the growing risks associated with supply chain vulnerabilities in cybersecurity. While specific details about the compromised data remain undisclosed, the incident underscores the challenges organizations face in securing sensitive information when relying on external vendors. Viking Line’s confirmation follows a pattern of recent high-profile breaches linked to third-party exposures, emphasizing the need for stricter vendor risk management. No timeline for the breach or the identity of the affected supplier has been publicly released. The incident serves as a reminder of the cascading impact cyberattacks can have on interconnected business ecosystems.