Fifteen years of maritime cyber incidents, animated
As of 15 October 2026, my maritime cyber incident dataset, which I have compiled for more than six years, holds 4,622 incidents dated from 2012 to today. To see how it came together, I ran Gource, a free tool built to animate the history of a code repository, on the records themselves.
Each dot is one incident, placed at the date it happened and coloured by type, including denial of service (DoS) and ransomware. The legend at the bottom right gives the colours. The silhouettes moving around stand for the origin category, such as hacktivism or cybercrime. No group or victim name appears.
By victim country
Grouped by country, incidents first form an American mass: 584 incidents, ahead of Italy (311), Germany (259), the United Kingdom (248) and France (208). The 37 countries with at least 25 incidents each get their own branch. The 567 incidents of the others are gathered in an “Other countries” branch.
The screen stays sparse until 2019: 232 incidents in eight years. The year 2023 alone holds 536.
By activity
The same data grouped by activity puts ports at the centre with 1,158 incidents, a quarter of the total, ahead of shipping (623) and logistics (452).
Ports are mostly hit by denial of service: 907 of their 1,158 incidents fall in that family, usually on the strength of a claim. A claim does not mean the site went down, and the weight of ports owes something to that way of counting.
By threat type
Grouping by threat type makes that weight visible. Denial of service totals 2,505 incidents, 54% of the dataset, against 1,091 for ransomware.
The colour of denial of service covers the screen from 2023, the year the total goes from 149 to 536 incidents: 381 of those 536 are denial of service. Hacktivist campaigns of that period weigh heavily here, including the one against a Romanian port ecosystem, and 2026 extends the trend. The 2023 figures give the picture of that year.
Excluding denial of service
Removing denial of service gives another curve: 2,119 incidents since 2012, including 155 in 2023, 501 in 2025 and 628 since January 2026. Ransomware rises from 38 incidents in 2020 to 301 in 2025, then 351 this year.
Ports lose first place here. Ransomware victims are found first in manufacturing (258 incidents) and logistics (194), ahead of ports (133). Cybercriminals are opportunistic: they exploit the access they find, whatever the sector.
Ransomware only
Isolated, the 1,088 ransomware incidents spread over 20 activities, with manufacturing and logistics in the lead. The rise is steady from 2020.
Denial of service only
Isolated in turn, denial of service holds 2,505 incidents, spread over 22 branches including “Other countries”. Of these, 381 date from 2023.
Reading notes
The dataset only lists incidents that are public or claimed. It gives a very small idea of actual activity, most of which stays out of sight. Each dot carries the date of the incident. An incident from 2019 recorded in 2026 therefore appears in 2019. Recent years are better covered than older ones, which steepens the slope at the end. The 25-incident threshold for getting a branch is a legibility choice. Finally, 2026 stops on 15 October.
