Threat Actor Claims Viking Line Breach Exposed Passenger and Payment Data

Summary

Threat actor bytetobreach claims it breached Viking Line and published passenger and NetAxept payment data, credentials and vehicle plates. The actor says it exploited a 2021 Solr LFI to obtain Tomcat credentials; the claims are unverified.

Key points

bytetobreach claims it exfiltrated Viking Line’s passenger database, including vehicle registration plates; the breach is not independently confirmed.
The actor reportedly published a separate NetAxept dataset linking passenger identities with onboard transactions and purchase histories.
The actor describes exploiting a 2021 Solr LFI to obtain Tomcat credentials, upload a JSP reverse shell and pivot to a master server.
The reported leaked material includes system accounts and credentials; the article says the total number of records is unknown.

Article Details

Victim Organization: Viking Line
Incident Type: Alleged data breach and exfiltration
Data Types Exposed: Passenger database records
Vehicle registration plates
System accounts and credentials
Payment transactions and purchase histories
Affected Records: Unknown
Operational Impact: No operational disruption is reported. Leaked items reportedly included frontend/backend access, system accounts and credentials, and database download links.
Ransom Or Extortion: No ransom or extortion demand is reported; the data was reportedly published freely.
Claim Status: claimed

MITRE ATT&CK

T1505.003 · Web ShellThe actor claims to have uploaded a JSP reverse shell to a server.

Threat Actors

ByteToBreachThe actor claims responsibility for breaching Viking Line, exfiltrating passenger and payment data, and publishing the data. The breach and claimed activity are not independently confirmed in the article.

Products

Apache SolrThey also published a correlated NetAxept payment dataset tying passengers to onboard transactions and detailed an attack chain exploiting a 2021 Solr LFI to obtain Tomcat credentials and deploy a reverse shell.NetAxeptThey also published a correlated NetAxept payment dataset tying passengers to onboard transactions and detailed an attack chain exploiting a 2021 Solr LFI to obtain Tomcat credentials and deploy a reverse shell.TomcatThey also published a correlated NetAxept payment dataset tying passengers to onboard transactions and detailed an attack chain exploiting a 2021 Solr LFI to obtain Tomcat credentials and deploy a reverse shell.