MalwareTransportation & LogisticsHospitalityTransportationRansomwareData EncryptedData ExfiltratedData PublishedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Hurtigruten

bd_d50a0c6264f2ed20 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 14, 2020

Filed

Mar 2, 2021

To disclose

11 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

64%

Full breach record for Hurtigruten →

Hurtigruten disclosed a ransomware incident where an unauthorized actor gained remote access to its network on December 14, 2020, encrypting parts of computer systems. The actor exfiltrated and later published guest data including names, dates of birth, passport numbers, and contact information for guests on MS Fram and MS Midnatsol voyages between 2016-2020. Credit card and SSN data were not affected. Hurtigruten contained the incident, engaged forensics, notified law enforcement (Norwegian and FBI), and offered 12 months of identity theft protection.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 14, 2020 → Notified Feb 18, 202166d ✗ CA 60-day late11 weeks discovery → filing

Incident timeline

discovery → filing · 11 weeks / 78 days

Dec 14, 2020

Begins

Dec 14, 2020

Discovered

Mar 2, 2021

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_8189c3af2577e54f2021-03-01 · +1dCandidate
Indiana State AGbd_b32cf2b00cd7a0002021-03-01 · +1dVerified

Name: Hurtigruten
norm: hurtigruten
Domain: hurtigruten.com

Name: Hurtigruten
norm: hurtigruten
Domain: hurtigruten.com
Industry: Transportation & LogisticsllmHospitalityllm

Discovered: Dec 14, 2020
Breach occurred: Dec 14, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 18, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Reported to Norwegian law enforcementReported to the Norwegian Data Protection AuthorityNotified the Federal Bureau of InvestigationNotified other applicable privacy regulatory authorities

During the incident: Disabled affected computer systems
Took down their internet connection to prevent any further intrusion
Launched a forensic investigation to determine the nature and scope of the incident
Reported this matter to Norwegian law enforcement and the Norwegian Data Protection Authority
Notified the Federal Bureau of Investigation
Notified other applicable privacy regulatory authorities
Retained NortonLifeLock to provide 12 months of complimentary LifeLock DefenderTM Choice identity theft protection
Changes made: Strengthened data privacy and cyber security efforts
Working closely with third-party cybersecurity experts to further enhance the security of our systems and reduce the risk of a similar event happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(78 days from discovery to filing)
Compliance flags: CA 60-day late · 66d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 14, 2020
→ Notified: Feb 18, 2021
66d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 14, 2020 → Notified: Feb 18, 2021	66d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGMar 1 · first

Indiana State AGMar 1 · first

California State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-538836
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 2, 2021
Raw hash: cb38e978104b203642aa0df28f166349818cbd9a63be739c8ba039b32ad541fb

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHurtigruten

Victim entityHurtigruten

Incidentdiscovered Dec 14, 2020

Stated responseDisabled affected computer systems

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov