Viking Line confirms data breach linked to third-party supplier

The Åland-based ferry operator Viking Line has confirmed a data breach involving customer information after a cybersecurity incident at one of its third-party service providers.

The breach affects passengers who placed advance orders for duty-free goods to be collected with their vehicles while traveling on Viking Line vessels. The company said the incident occurred through a subcontractor responsible for handling pre-order services for onboard purchases and reservations.

The exposed information relates specifically to customers who used the pre-order system rather than the broader passenger base. The company stated that the compromised data includes order amounts and vehicle associations tied to the purchases. Credit card information is not believed to have been exposed.

Viking Line said the breach was identified earlier this week and is now under active investigation. A large internal response team is examining the incident alongside external cybersecurity specialists to determine the full scope of the exposure.

The company confirmed that certain traveler data was leaked but described the compromised information as limited. Operational systems remain unaffected, and no disruption to voyages or core booking services has been identified.

A threat actor using the alias “bytetobreach” has claimed responsibility for the intrusion on dark web forums. The actor alleges that access was gained to a passenger database containing vehicle registration information and payment transaction records associated with onboard services processed through the NetAxept application programming interface.

The threat actor has also claimed that samples of the stolen data were released publicly for download.

Viking Line stated that the breach has been reported to authorities in Finland and that investigations are continuing to determine the exact extent of the exposed information and whether additional customer records were affected.