Maritime Cyber Attacks Are Not Hypothetical

USCG Marine Safety Alert - Deep Draft Vessel Malware

The US Coast Guard issued Marine Safety Alert 06-19 after a deep draft vessel arriving at the Port of New York reported that its shipboard computer network had been "significantly degraded" by malware. The investigation found that the malware had severely disrupted onboard systems, though it had not affected vessel control systems. The USCG noted that the vessel operated without effective cybersecurity measures - most crew members used the same login credentials, there were no antivirus protections, and critical control systems shared the network with general-purpose crew computers. This incident directly prompted the USCG to accelerate maritime cybersecurity rulemaking.

Ferry "Fantastic" - OT System RAT Infection

A Remote Access Trojan (RAT) was discovered on the operational technology systems of the ferry "Fantastic." Unlike typical IT-focused attacks, this malware had penetrated systems responsible for vessel operations rather than administrative functions. RAT infections on OT systems are particularly dangerous because they give attackers persistent, hidden access to systems that control physical processes - propulsion, steering, ballast, and safety systems. The incident highlighted the ongoing vulnerability of vessel OT networks that are often poorly segmented from IT systems.

Naval Dome Live Penetration Test

Israeli cybersecurity firm Naval Dome conducted a live penetration test on a vessel's systems that demonstrated the severity of maritime cyber vulnerabilities. Starting with a single phishing email sent to the captain, the testers were able to shift the vessel's reported GPS position, mislead the radar display with false targets, disable machinery monitoring systems, and override fuel and ballast pump controls. Every system was compromised through a single initial access point. The test demonstrated that vessel cyber attacks are not just a data confidentiality issue - they can directly affect the physical safety of the ship, its crew, and its cargo.

USB-Borne Malware - The Primary Infection Vector

CYTUR's 2026 white paper identifies unverified USB flash drives, phishing attachments and insecure onboard public Wi-Fi as the principal vectors by which malware reaches internal vessel networks. Antonio Cassidy, director of services at the maritime cyber security firm CyberOwl, put a number on it in September 2026: of the attempted intrusions CyberOwl detected across the vessels it monitors, more than half involved malware introduced through storage devices. He also reported a sharp rise in shipboard incidents over the first half of 2026. Crew members, service engineers, port officials, and surveyors routinely connect USB devices to vessel systems for chart updates, software patches, data transfers, and personal use. Many vessel systems lack USB port controls, endpoint protection, or any form of removable media policy enforcement. The problem is compounded by the fact that critical systems such as ECDIS often require USB-based updates, making a complete USB ban impractical without alternative update mechanisms.

ECDIS Vulnerability - Legacy Operating Systems

The majority of Electronic Chart Display and Information Systems (ECDIS) in service still run on Windows XP or Windows NT - operating systems that have not received security patches for years. These systems are trivially compromised by known exploits that are freely available online. ECDIS is the primary navigation tool on modern vessels, and its compromise can result in incorrect chart data, false position plotting, or complete navigation failure. The maritime industry's slow hardware refresh cycle means vessels regularly operate with navigation-critical systems that would be considered unacceptably insecure in any other industry.

Iranian Vessel Communications Attack

In 2025, a coordinated cyber attack paralysed the communications systems of approximately 180 Iranian-linked vessels in two distinct waves. The vessels lost the ability to communicate with shore-based operations, port authorities, and each other. The attack demonstrated that vessel communications infrastructure - satellite terminals, VSAT systems, and fleet management platforms - represents a critical single point of failure that can be exploited to effectively blind an entire fleet simultaneously.

Black Sea Mass Spoofing

More than 20 vessels in the Black Sea simultaneously reported GPS positions that placed them at Gelendzhik Airport, over 30 kilometres inland. The master of one affected vessel reported that his GPS showed the ship's position deep inside Russian territory while the vessel was clearly at sea. This was the first publicly documented large-scale GPS spoofing event affecting commercial shipping and demonstrated that spoofing could affect multiple vessels simultaneously across a wide area.

Shanghai / Huangpu River Spoofing

Hundreds of vessels transiting the Huangpu River and the Port of Shanghai experienced GPS spoofing that caused their AIS positions to jump erratically, sometimes forming circular patterns. Research by the Center for Advanced Defense Studies documented the phenomenon extensively. The spoofing appeared to affect specific areas near port facilities and continued intermittently over an extended period. The cause was not publicly attributed, but the pattern suggested a localised source rather than wide-area military activity.

Eastern Mediterranean Spoofing

GPS spoofing in the Eastern Mediterranean reached a scale where 117 ships were simultaneously showing false positions at Beirut-Rafic Hariri International Airport. Vessels in transit through one of the world's busiest shipping corridors found their navigation systems reporting positions kilometres from their actual locations. The spoofing was linked to broader GPS interference in the region associated with military operations, but commercial vessels bore the operational consequences regardless of the intended target.

Persian Gulf Disruption

In 2025, GPS spoofing and jamming in the Persian Gulf region disrupted navigation for approximately 3,000 vessels over a two-week period. The Strait of Hormuz, through which roughly 20% of the world's oil passes, became an area of persistent navigation uncertainty. Vessels were forced to increase reliance on radar, visual navigation, and manual position fixing - skills that modern bridge crews, trained primarily on electronic navigation, may not maintain to the required standard.

MSC Antonia Grounding

The 7,000 TEU container ship MSC Antonia ran aground, with GPS spoofing identified as a contributing factor to the incident. While groundings have multiple causes including human factors and environmental conditions, the MSC Antonia case represented a concrete example of GPS spoofing contributing to a major maritime casualty involving a large commercial vessel. The incident underlined that GPS spoofing is not merely an inconvenience - it can lead to physical damage, environmental risk, and significant financial loss.

The Scale of GPS Disruption

CYTUR's 2026 white paper records over 1,000 vessels a day affected by signal interference in the Red Sea region alone, and European authorities have warned separately about persistent interference in the Baltic. This figure includes both jamming (signal denial) and spoofing (false signal injection). What was once a rare and noteworthy event has become a daily operational reality for commercial shipping. Vessels operating in the Eastern Mediterranean, Black Sea, Persian Gulf, and parts of the South China Sea face near-continuous GPS interference that degrades the reliability of electronic navigation systems.

DNV ShipManager Ransomware

DNV, one of the world's largest maritime classification societies, suffered a ransomware attack on its ShipManager software platform. Approximately 1,000 vessels across 70 operators were affected when DNV was forced to shut down the platform's servers. ShipManager handles fleet operations including maintenance management, procurement, crew management, and quality and health/safety systems. While the attack did not directly compromise onboard systems, vessels lost access to their fleet management platform, disrupting maintenance planning, regulatory documentation, and operational workflows. The incident demonstrated that vessel operations have become deeply dependent on shore-based software supply chains, and that a single attack on a widely-used platform can affect an entire segment of the global fleet.

North Carolina Ports

North Carolina Ports confirmed a cyber attack that disrupted IT systems across the Port of Wilmington, the Port of Morehead City and the Charlotte Inland Port. The authority activated its cybersecurity contingency plan, ran gates manually while systems were restored, and engaged state agencies alongside the US Coast Guard. A spokesperson said the breach had been contained and the organisation was “in the recovery process”. No group claimed responsibility, ransomware was never confirmed, and no data theft was established. The instructive part is the blast radius: one IT compromise degraded three physically separate facilities at once, because what they share is back-office systems rather than quaysides.

Shipping Association of New York & New Jersey

The Qilin ransomware group claimed a breach of the Shipping Association of New York & New Jersey, the body representing terminal operators, ocean carriers, stevedores and other businesses moving cargo through one of North America's busiest ports. The target was not a vessel or a terminal but the industry association connecting them, which is exactly the kind of shared organisation that holds commercially sensitive data on many operators at once while rarely being covered by any individual operator's risk assessment.

Adriatic Port Authority — Port of Ancona

The Adriatic Port Authority, which operates Italy's Port of Ancona, was attacked on 11 December 2025. In its own public statement the authority said the attack “succeeded in taking only 2%” of its information, and that Italy's Digital Agency notified it on 14 January that the attack had been carried out by the Anubis group, which then leaked the data. Reporting on the leaked material puts it at roughly 56,000 files, including employee records and — more seriously — port safety plans and details of security operations.

Two things make this the most instructive incident of the three. The attackers reportedly gained access by spear-phishing staff at the company managing the port and moved laterally through cloud accounts; they never needed to touch operational technology to cripple the organisation. And the stolen material is the kind that retains value long after the systems are restored, because security plans describe how a port is protected.

Port of Nagoya Ransomware

The Port of Nagoya, which handles approximately 10% of Japan's total trade volume, was hit by LockBit ransomware that forced the suspension of all container terminal operations for two and a half days. The Nagoya United Container Terminal System, which manages the movement of containers in and out of the port, was completely disabled. Vessels waiting to load or discharge cargo were held in port or diverted. The attack affected Toyota's supply chain, as the automaker ships a significant portion of its exports through Nagoya. The port resumed operations only after rebuilding affected systems.

DP World Australia

A cyber attack on DP World Australia, which operates container terminals in Sydney, Melbourne, Brisbane, and Fremantle, forced the company to disconnect its systems from the internet to contain the breach. The disconnection halted container movements at ports handling approximately 40% of Australia's container imports. Around 30,000 containers were stranded, with vessels unable to discharge cargo. Normal operations took days to restore, and the incident caused weeks of supply chain disruption as the backlog was cleared.

Shahid Rajaee Port, Iran

A state-sponsored cyber attack targeted the Shahid Rajaee Port near Bandar Abbas, Iran's busiest container port. The attack disrupted the port's computer systems controlling vessel traffic, creating a backlog of ships waiting to enter the port and causing chaos in the movement of cargo. Satellite imagery showed vessels queuing in the approaches while the port struggled to restore operations. The attack was widely attributed to state-level actors, demonstrating that port infrastructure is a target in geopolitical conflicts, with commercial vessel operators caught in the middle.

MTSA Facility Ryuk Ransomware

The US Coast Guard issued Marine Safety Information Bulletin 20-02 after a Maritime Transportation Security Act (MTSA) regulated facility was hit by Ryuk ransomware. The attack disabled CCTV surveillance, physical access control systems, and critical process control monitoring equipment. The facility's entire operational technology environment was compromised through a phishing email that led to ransomware deployment. The incident forced the facility to operate with degraded security and monitoring capabilities for over 30 hours while systems were restored.

Maersk - NotPetya

The NotPetya malware struck Maersk's corporate IT infrastructure through a compromised Ukrainian accounting software update. This was an office-based IT attack, not a vessel cyber attack. However, the impact cascaded to vessel operations because Maersk's booking systems, terminal operating systems, and communications infrastructure were all affected. The company lost access to its global network for approximately two weeks, forcing vessel scheduling to be managed manually and disrupting port terminal operations worldwide. Maersk estimated the total cost at approximately $300 million. The incident remains the most cited maritime cyber event, but it is important to understand that it was a corporate IT attack that affected vessel operations through business system dependencies, not through any compromise of onboard vessel systems.

COSCO Shipping

COSCO Shipping's US operations were disrupted by a ransomware attack that affected email, telephone, and network connectivity at its Americas headquarters. The attack did not reach vessel systems but disrupted booking and documentation processes for vessels calling at US ports. COSCO isolated its Americas network from its global operations to prevent spread.

Mediterranean Shipping Company (MSC)

MSC's Geneva headquarters suffered a malware attack that brought down its website and disrupted booking and cargo tracking systems for several days. Container booking and release processes were affected, impacting vessel loading schedules. The attack was contained to shore-side systems and did not affect vessel operations directly, but the disruption to commercial and logistics platforms had downstream effects on vessel utilisation and port scheduling.

CMA CGM

CMA CGM, the world's fourth-largest container shipping line, was hit by Ragnar Locker ransomware that encrypted data across its corporate network. The company was forced to shut down its online booking platform and customer-facing systems. Vessel operations continued but with degraded commercial support - bookings were processed manually, and cargo tracking was unavailable. The attack demonstrated that even the largest shipping operators remain vulnerable to corporate ransomware, and that the commercial systems vessels depend on for cargo operations are part of the vessel's extended attack surface.