Marine cyber incidents

Since the 2017 A.P. Møller-Maersk NotPetya attack, cyber incidents have become one of the highest-cost operational risks in shipping. Every major cyber attack has driven regulatory reform (IMO Res. MSC.428(98) 2017, IACS UR E26/E27 mandatory 2024) + industry practice change (segregated IT/OT networks, offline navigation backups, incident response drills). This reference catalogs the significant public cyber incidents in the maritime sector + their operational + regulatory lessons.

Notable cases

A.P. Møller-Maersk NotPetya (June 2017)

The defining modern maritime cyber incident. The NotPetya wiper (Russian GRU-attributed, disguised as Petya ransomware) propagated through the Ukrainian tax accounting software M.E.Doc into Maersk's global network on 27 June 2017. Within hours all Maersk global email, port terminal management, container tracking + booking systems went dark. ~4,000 servers + ~45,000 workstations required complete rebuild. Total commercial loss estimated at $250-300 million. Ships continued to sail (bridge systems isolated) but shore-side chaos disrupted container flows for 2+ weeks. Chairman Jim Snabe famously cited a coincidentally-offline Ghana office domain controller that survived to speed the recovery. Maersk NotPetya became the definitive modern case for IT/OT segregation, offline domain controller backup, and immutable-backup disaster recovery.

COSCO Shipping Lines cyber attack (July 2018)

COSCO Americas offices suffered a ransomware attack affecting Long Beach + other US terminal operations. Response was rapid (~5 days to full recovery) — largely credited to network segmentation put in place after Maersk NotPetya. Case demonstrates the industry's post-Maersk learning curve.

MSC Mediterranean Shipping Company (April 2020)

MSC HQ Geneva suffered a network outage attributed to an internal malware infection. Booking systems + tracking down for 5 days at peak COVID cargo-flow crisis. MSC (privately-held) never confirmed ransomware attribution but industry consensus + insurance-market chatter placed it in the ransomware category. Notable for demonstrating that even major post-Maersk shipping companies still face substantial cyber-incident exposure.

CMA CGM ransomware (September 2020)

CMA CGM confirmed a ragnar-locker ransomware attack affecting shore-based IT + booking + eBusiness portals. Vessel operations continued but shore-based systems down for ~2 weeks. CMA CGM disclosure was more transparent than MSC + INTL Maritime Bureau + industry associations subsequently issued heightened alert.

USCG Maritime Advisory 05-19 (2019)

USCG issued Maritime Safety Alert 06-19 (July 2019) documenting a cyber incident affecting a deep-draft vessel bound for Port of New York/New Jersey. Malware disabled the ship's network + shore-communications; navigation continued via GPS + ECDIS but administrative + business systems down. USCG required vessel to implement measures before further US port calls — the first US enforcement action on maritime cyber.

JNPT (Jawaharlal Nehru Port Trust) ransomware (February 2022)

India's largest container terminal suffered a ransomware attack disrupting container gate operations for 24-48 hours. Impact was contained by terminal automation redundancy but the incident demonstrated the sector-wide risk to critical port infrastructure. Indian CERT-In advisories subsequently strengthened maritime cyber-security-audit requirements.

DP World Australia ransomware (November 2023)

One of the most disruptive port cyber attacks to date. DP World Australia (operator of ~40% of Australian container throughput) suffered a ransomware attack on 10 November 2023 that forced closure of Melbourne + Sydney + Brisbane + Fremantle container terminals for ~4 days. ~30,000 containers stranded on quay. Attributed to a Russian threat actor. Case became the definitive modern example of port cyber attack impact on national supply chain + drove Australian Government Critical Infrastructure Security Act 2018 amendments tightening port operator cyber requirements.

Port of Nagoya ransomware (July 2023)

Japan's largest port terminal management system (UTMS) was affected by LockBit 3.0 ransomware. Container operations halted for 3 days. Case exposed the concentration risk of common port-terminal-management-system software across multiple ports.

MMSA + FMS (Multiple Small Operators, 2022-2024)

Post-2020, the risk shifted from headline-grabbing megacarrier attacks to persistent lower-visibility attacks on smaller operators + specialised operators. IUMI + P&I clubs report a consistent 20-30% year-over-year increase in reported maritime cyber incidents 2020-2024, with the median incident affecting a small-to-mid operator + producing $1-5M loss + 5-14 days operational disruption.

Common attack patterns

Ransomware. Dominant attack pattern in 2020-2024. Encryption of shore-based IT systems + booking + tracking + email. Ships largely unaffected due to network segregation but shore-side chaos disrupts operations. Recovery from immutable backup + rebuild.
Phishing + credential theft. Entry vector for most ransomware. Emails masquerading as booking confirmations, port authority notices, or class-society survey reports.
Supply chain compromise. Compromised third-party software vendor (Maersk-M.E.Doc pattern) or terminal management system (Port of Nagoya UTMS pattern).
GPS spoofing. Growing incident category. Vessels report GPS position jumping to phantom locations — attributed to jamming/spoofing near sanctioned coasts (Russian Black Sea, Iranian Persian Gulf, Chinese Taiwan Strait).
Bridge equipment intrusion. Rare but growing category. Direct compromise of ECDIS or bridge network via USB or contractor equipment. IACS UR E26/E27 designed to prevent.
Business email compromise. Fraudulent bunker payment redirection + fake invoice fraud + payroll diversion. High-frequency, mid-value attacks affecting essentially every operator at some point.

Regulatory + industry response

IMO Res. MSC.428(98) (2017). Maritime Cyber Risk Management — mandatory since 1 January 2021. Requires cyber risk to be documented in the vessel Safety Management System (SMS) under ISM Code.
IACS UR E26/E27 (mandatory 1 Jul 2024). Cyber resilience of new-build vessels + on-board systems. See /reference/iacs-ur-catalog.
BIMCO Guidelines on Cyber Security Onboard Ships (v4, 2020). Industry standard reference for shipboard cyber risk assessment.
BIMCO Cyber Security Clause 2020. Standard charterparty clause allocating cyber-incident liability. See /reference/bimco-clauses.
US CG NVIC 01-20. USCG guidance on vessel cyber-risk management + reporting. See /reference/uscg-nvic.
P&I coverage. IG P&I Clubs now typically extend basic cyber coverage under standard rules, with specific exclusions for state-sponsored cyber warfare (a growing exclusion category).

Practical shipboard checklist

SMS documents cyber risk assessment + mitigation measures per MSC.428(98).
Network segregation between IT (business) + OT (bridge + engine control + navigation) systems.
USB media control policy + physical access controls on bridge + engine room.
Software patch schedule + antivirus updated at reasonable frequency.
Incident response procedure + drill schedule (annual minimum, per IMO guidance).
Backup + offline recovery capability for critical shore-communications systems.
Paper chart + paper log + traditional compass + sextant backup for navigation (increasingly restored on modern bridges as OT-attack contingency).