Maritime and port cybersecurity.

As of 15 October 2026, my maritime cyber incident dataset, which I have compiled for more than six years, holds 4,622 incidents dated from 2012 to today. To see how it came together, I ran Gource, a free tool built to animate the history of a code repository, on the records themselves.

Each dot is one incident, placed at the date it happened and coloured by type, including denial of service (DoS) and ransomware. The legend at the bottom right gives the colours. The silhouettes moving around stand for the origin category, such as hacktivism or cybercrime. No group or victim name appears.

On 12 October 2026, between 13:53 and 14:16 UTC, the leak site of a recent cybercriminal group calling itself n0n listed 38 organisations [1] [2]. Each entry carries the mention “unpaid”. These listings rest solely on the group’s own claim, which no victim has confirmed to my knowledge. Of the 38 organisations named, 34 belong to shipping, ports and terminals.

The group has been publicly active for less than a month, which calls for caution about its origin and methods. Its first activity is detected on 18 September 2026, and its leak site, reachable through Tor, appears on the 21st. By the 22nd it already claims more than a dozen victims [3]. They include a customer relations provider (87 million records claimed) and a Venezuelan internet access provider. SOCRadar counts 21 victims in 17 countries before the maritime batch, most of them outside the sector, and places the group probably in Russia. No link to an earlier group is documented.

As of 15 October 2026, my maritime cyber incident dataset already holds 1,397 incidents for 2026. The full year 2025 holds 1,352. At the same date in 2025, we stood at 1,040, a gap of 34%.

Yet the first half of the year looked much like 2025. From January to June 2026, 617 events could be counted, against 649 over the same period in 2025. The reversal comes in July. From July to September 2026, the dataset records 653 events, including… 261 for August alone against 112 last year (poor CISOs, who never get a holiday).

On 12 October 2026 (after plenty of alerts, press coverage and what have you), CERT-FR published, cold, an alert about “numerous compromises” of remote controllers for refrigeration installations. It first covered Danfoss AK-SC and AK-SM units, and an update on 13 October added Copeland xweb and Dixell xweb controllers [1]. The attacks date from the night of 11 to 12 October (attacking at night and over the weekend is, after all, the most damaging pattern). The alert points - surprise - to administration interfaces exposed directly on the Internet. CERT-FR asks (what ANSSI has been recommending for years) that exposure be removed, that equipment be reached only through a VPN (Virtual Private Network) or a protected network, that equipment be updated (well, often it is end-of-life…) and that default passwords be changed.

Recently a researcher wrote about me, behind the paywall of an academic paper, without consulting me or offering a right of reply, that when I spoke up it was to praise the resilience of the maritime sector and to argue that attacks on it are impossible. For someone who has worked on the subject for more than 25 years, who started this blog in 2017 (when maritime cyber was still of no interest to anyone), who built the first global database of maritime cybersecurity incidents more than five years ago, and who describes part of it here, you will find that as funny as I do.

To those researchers, if you have a minimum of ethics and consideration, allow me only the freedom not to fan the flames when an incident happens, and to avoid on those occasions, out of modesty or out of ethics, reaching every time for the “I told you so” or the “if you need me, I am here”.

An LNG carrier loaded with American gas is still looking for somewhere to deliver her cargo, a month after leaving Louisiana. She gave up the Adriatic terminal, then Barcelona, and is now heading for Gibraltar. Her crew reported losing access to shipboard systems in early September. She is the third ship in a month whose crew suspects a cyberattack. The Italian Coast Guard describes a malfunction whose cause could not be determined. Three successive publications, each more precise than the last, speak of a cyberattack, and none of them comes from a party with access to the ship.