The Reality of Ship Security, Seen Through Maritime Cyber Incidents

Why Start with Real Incidents

A maritime cyber breach can begin in a single system, spread into port and cargo infrastructure, and end in physical damage, logistics disruption and financial loss. That is why meeting regulatory requirements is not enough on its own. Real incidents make it clear where threats get in, what they bring to a halt, and how long recovery takes.

Four Types of Threat

Source: Criminal IP (Cyber Threat Intelligence Search engine)

Timeline of Major Incidents, 2016–2025

• 2016 — GPS jamming targeting South Korea: GPS malfunctions on 52 ships and 58 aircraft
• 2017 — Maersk NotPetya: around 50,000 endpoints and thousands of applications and servers infected across 600 sites in 130 countries
• 2017 — Svitzer data breach: email from 3 employees' accounts automatically forwarded externally for 11 months
• 2018 — COSCO Shipping ransomware: website and email systems of the Americas offices paralysed
• 2018 — MSC malware: data centre network outage took down the website and customer portal
• 2018 — Large-scale Black Sea attack: around 20 ships affected by GPS spoofing
• 2019 — Kuwaiti maritime transport agency: malicious backdoor installed for post-intrusion activity
• 2019 — Port of San Diego, US: credentials stolen through malware
• 2020 — International Maritime Organization (IMO): attack on IT systems disrupted services
• 2020 — CMA CGM ransomware: attack on peripheral servers; internal network shut off to stop the spread
• 2021 — Two K-Line malware incidents: intrusion into the IT network and unauthorised access to overseas subsidiaries' systems
• 2021 — Transnet: damage to IT systems halted port terminal operations
• 2022 — DNV ransomware: servers for crew and maintenance scheduling software used by around 1,000 vessels worldwide taken offline
• 2022 — Swire Pacific: unauthorised access to IT systems led to the leak of some commercially sensitive and personal data
• 2023 — DP World Australia: port operations in Melbourne, Sydney, Brisbane and Perth disrupted for several days; linked to an unpatched vulnerability (CitrixBleed)
• 2023 — HMM: email servers affected in some areas
• 2023 — Indian port container terminal: ransomware hit the terminal Management Information System (MIS)
• 2024 — Port of Seattle, US: attack by the Rhysida ransomware group disrupted airport and port operations
• 2025 — Iran's NITC and IRISL: a hacker group claimed to have breached the communications networks of 116 vessels

Source: Factiva and media reports

What Three Incidents in 2025 Revealed

North Sea collision — a possible cyber cause raised (11 March 2025)

After the Solong collided with the US-flagged Stena Immaculate, 142,000 barrels of jet fuel kept burning off the Yorkshire coast. White House officials did not rule out a deliberate act, and speculation followed that the Solong might have been hacked. Even though the cause has not been confirmed, what matters is that the very assumption that onboard systems could lose control to an outside party is now part of accident investigation. This is the territory UR E27 addresses.

VSAT attack on Iran's fleet — the risk of non-mandatory systems (21 March 2025)

The hacker group Lab Dookhtegan claimed a large-scale attack on Iran's fleet. The attack disabled VSAT-based communication systems on 116 vessels — 50 belonging to the National Iranian Tanker Company (NITC) and 66 to the Islamic Republic of Iran Shipping Lines (IRISL). Communications between the ships, ports and external networks were cut, and full recovery was expected to take weeks.

The lesson of this incident is that compliance with E26/E27 alone is not enough. If systems outside the mandatory scope (such as VSAT) are overlooked, ships remain dangerously exposed. A strategy that reduces the attack surface itself is needed.

MSC Antonia grounding — a system failure that could have been tested (10 May 2025)

The container ship MSC Antonia ran aground near Eliza Shoals, south of the port of Jeddah in the Red Sea. Several intelligence providers, including Windward, Pole Star Global and MarineTraffic, reached the same conclusion: the ship's GPS signal had been deliberately spoofed.

GPS spoofing is not conceptually complex. A transmitter broadcasts a fake signal stronger than the real satellite signal. The ship's GNSS believed it was somewhere else, and the crew navigated accordingly. The reef was real; the coordinates were not. This incident was not an accident of chance but a system failure that could have been tested in advance.

How AI Has Lowered the Barrier to Attack

According to a Bloomberg report in February 2026, an unidentified attacker carried out attacks on Mexican government agencies using nothing more than two general-purpose AI subscription services. Without any custom malware or C2 servers, the attacker reportedly ran the entire attack chain — from reconnaissance and vulnerability identification to exploit generation, credential stuffing and data exfiltration. The analysis was published by Israeli security firm Gambit Security, and the AI service provider permanently suspended the accounts involved.

Although this case does not directly involve shipping, the implication is clear: the barrier to offensive capability has collapsed. What once only skilled attack groups could do can now be attempted with far fewer resources. Defenders have to move at the same speed, and that is why AI-driven SecOps is needed.

Key Takeaways

1. Threats spread from IT to OT. Most incidents began in email, web or servers, but ended in port shutdowns and disrupted ship operations.
2. Navigation systems are direct targets. GPS jamming and spoofing have recurred from 2016 through 2025.
3. Regulatory compliance is the baseline. Systems outside the mandatory scope also become attack paths.
4. Recovery time is cost. Maersk's 3 weeks and the Iranian fleet's several weeks all translate into operational losses.

Taking these real incidents as its starting point, Gwangmyung Maritime reduces the attack surface from the design stage and builds detection and recovery capabilities into the operational stage.