The Maritime Sector Maritime Information Systems Risks News About Services Contact FR

Contents

Known incidents

 included in  Risks
   3175 words   15 minutes 
Contents

This article lists nearly 80 public incidents that have affected the maritime sector, deliberately or otherwise, over the past twenty years. It is not intended to be exhaustive, but please let me know if you are aware of other public and corroborated cases. The aim is not to single out a company or a state, but to raise awareness of incidents that have already occurred and, when known, their consequences. I will add more over time. As always, attribution and sources should be treated with caution, as should the apparent increase in the public number of incidents. I am also gradually adding submarine cable outages.

Why is it so difficult to obtain a comprehensive view of incidents?

  1. Because reporting them, whether publicly or privately, is not mandatory in many countries, and there is often no central reporting body.
  2. Because it damages a company’s share price and reputation.
  3. Because the definition of a cyberattack varies greatly. Some consider a single ping from an unknown IP address to be a cyberattack. The Grand Port Maritime de Marseille, for example, stated that it was the target of 11,000 cyberattacks per week.
  4. Because a cyber event does not necessarily mean a cyberattack. A service outage caused by an IT failure is still a cybersecurity incident.

Beware of shortcuts as well: when a researcher demonstrates vulnerabilities, it does not automatically mean they are a hacker or that the action was carried out “for real.” There are also many approximations and misleading summaries. In maritime information systems, here is a good example among others, very well analyzed.

Warning: this article is no longer updated: the list of public maritime cybersecurity incidents is now maintained by the M-CERT of France Cyber Maritime, which I thank for taking over. The incidents previously listed in this article, as well as new ones, are therefore included in the ADMIRAL dataset maintained by the M-CERT ( https://www.m-cert.fr/admiral/ ).

2021:

  • 19 February 2021: Groupe Bénéteau was the victim of a cyberattack affecting several of its sites [ 1]
  • 18 February 2021: in the tense political context in Myanmar following the coup, the Myanmar Port Authority was hit by a cyberattack [ 1] [ 2]

2020:

  • 28 December 2020: German cruise operator AIDA Cruises was hit by a cyberattack [ 1] [ 2]. The incident reportedly also affected its vessels, as well as other ships in the Carnival group, which had already been hit by other cyberattacks that year.

  • 14 December 2020: Norwegian cruise operator Hurtigruten was hit by a ransomware attack [ 1]

  • 17 November 2020: the inland port of Kennewick, in the northwestern United States, was hit by a ransomware attack [1]

  • 30 September 2020: the International Maritime Organization was the target of a “sophisticated” cyberattack 1 2 3

  • 28 September 2020: French shipping company CMA CGM, the world’s fourth-largest carrier, was hit by the Ragnar Locker ransomware, which had already claimed many victims in France 1 2. A possible data theft was reported by the company. The company announced a return to normal on 11 October.

  • 20 September 2020: French multimodal freight operator GEFCO was hit by a ransomware attack

  • August-September 2020: various spear-phishing attacks targeted the U.S. Maritime Transportation System, notably by sending realistic fake emails impersonating the U.S. Coast Guard and containing malicious attachments.

  • 15 August 2020: an employee of classification society DNV-GL was arrested in Norway, suspected of having provided sensitive information on defense-related activities to foreign intelligence services.

  • 15 August 2020: Carnival Corporation & PLC, a cruise ship operator, was hit by a ransomware attack. It led to a major theft of personal data. [ 1]

  • 23 July 2020: Garmin, a manufacturer of GPS systems and maritime systems through its Navionics brand, was hit by a ransomware attack [ 1].

  • 19 June 2020: Fountaine Pajot was the victim of a cyberattack [ 1]

  • 9 June 2020: Norwegian shipyard Vard in Langsten was hit by a ransomware attack

  • 10 May 2020: one or more Iranian ports were hit by a cyberattack (notably Shahid Rajaee, near Bandar Abbas). Few precise details emerged [ 1].

  • May 2020: AIS “crop circles” off California 1

  • 5 May 2020: Australian transport group Toll Group, which is active in maritime freight among other sectors, was hit by a cyberattack involving the theft of personal data.

  • 10 April 2020: shipping company MSC was hit by a cyberattack, later confirmed by the company, which led it to temporarily shut down part of its logistics services.

  • 7/8 April 2020: Danish pump manufacturer DESMI, which serves the maritime sector, was hit by the Ragnar Locker ransomware 1

  • 21 March 2020: the Mespinoza/Pysa ransomware attack affecting the Aix-Marseille metropolitan area disrupted operations at Marseille/Fos Med Europe Terminal 1 2 3 4 5 6

  • 10 January 2020: French multimodal freight group Clasquin was hit by a Sodinokibi ransomware attack

  • January 2020: cuts to the WACS and SAT3 submarine telecommunications cables off Cameroon.

  • January 2020: during a TV report for a French television program about cruise ships, a password could clearly be seen written on a post-it stuck to an integrated screen (CCTV?) on the ship’s bridge.

  • January 2020: the Falcon submarine telecommunications cable, serving several countries on the Arabian Peninsula, was cut. Several tens of millions of people were affected.

2019:

2018 :

2017 :

  • 29/11: British company Clarkson, a major player in the UK maritime sector, was the victim of a cyberattack. Remote access to the company’s servers was made possible through the use of an access account that was later disabled. Very little information was provided on the volume of data that may have been exfiltrated. The company later issued a new statement, analyzed here.
  • 26/10: IOActive issued an alert regarding a vulnerability in certain Inmarsat satellite terminals (hard-coded credentials, SQL injection). No information was given on whether the vulnerability had been exploited. See Inmarsat’s response.
  • 16/10: a cyber campaign targeted the maritime and defense sectors in the United States and Western Europe. The spear-phishing group behind the campaign, known as Leviathan, has long shown interest in the maritime and defense sectors, especially shipbuilding.
  • July: BW Group, a major player in the oil industry, was the victim of a cyberattack. This appears to have involved remote access rather than ransomware.
  • July: the Eastern Africa Submarine System (EASSy), the only cable connecting Somalia to the rest of the world, was cut for three weeks after a container ship accidentally severed it. Estimated economic losses: €9 million per day (half of the country’s daily GDP).
  • 13/07: the Ro-Ro vessel Siem Cicero suffered a steering failure and grounded in the River Ems (Germany) after deviating from its route. The cause of the failure was a software error. Two tugboats were dispatched to tow the vessel back to the port of Emden. Various inspections carried out by divers did not reveal any impact on the hull. The software error, which was a design flaw as the vessel had been launched only ten days earlier, was corrected and the ship was then able to resume its voyage to Halifax.
  • 30/06: the port of Rotterdam was in turn hit by NotPetya. Although this is not clearly specified, Maersk is widely suspected. It is worth noting that the port of Rotterdam launched a strong initiative by creating a port cybersecurity officer and a hotline. In 2020, Admiral Lunday, head of Coast Guard Cyber Command, acknowledged during a conference that several U.S. ports had also been affected by NotPetya.
  • June: shipping company Maersk was hit by the NotPetya worm, which affected many countries and companies worldwide. The consequences for the well-known carrier were severe: the ports of Rotterdam, New York, Mumbai, and Argentina were shut down due to the inability to load containers. Losses are estimated at $300 million. The company had to reinstall no fewer than 4,000 servers, 45,000 PCs, and 2,500 applications… even retrieving a copy of its Active Directory from… Ghana by private jet. Its share price temporarily lost 15%. See also this article on the internal experience of the incident.
  • May: the APT.32 group had been conducting campaigns for several years (since 2014?) targeting, among others, the naval sector. Charming code name: Ocean Lotus.
  • 69% of Danish shipowners were affected by a cyber event during 2017.

2016 :

  • April (again): South Korean authorities ordered around 280 vessels back to port after observing major problems with their navigation systems (GPS jamming/spoofing?).

  • April: Daewoo Shipbuilding was the victim of a cyberattack: exfiltration of sensitive data, including warship blueprints. North Korea was blamed.

  • 02/03: the Gulf of Guinea anti-piracy center (Maritime Trade Information Sharing Center, Gulf of Guinea, MTISC-GoG) was affected by a flaw apparently exploited for data theft. Information reported by Maritime Executive, but denied by the center.

  • The administrative services of the port of Oakland were affected by a denial-of-service attack. Very little official information is available.

  • A shipowner suffered a cyberattack over several months, allowing criminals to identify containers of interest and divert their contents.

  • An email account belonging to a charterer was compromised. Funds intended to pay the agent were instead transferred to a bank account in Nigeria. The vessel was detained in port because the agent had not received the funds required in time to authorize departure.

  • An agent’s email accounts were compromised. An email was sent to the shipowner requesting a transfer to a new bank account. The shipowner did not verify the request and made the transfer. Total loss: $500,000 (which therefore required two transfers!).

  • See the survey conducted by IHS and BIMCO on cyber incidents in the sector during 2016.

2015 :

  • October: Breton company Sabella was affected. Its tidal turbine, submerged at a depth of 55 meters near the island of Ushant, had to be stopped for nearly 15 days after a ransomware attack (again) on the turbine’s control computer. This computer handled the satellite link between the turbine and the city of Quimper. However, the turbine was still in a test phase, so the incident had no impact on the electricity supply of Ushant. The ransom, known to have amounted to $4,000, was not paid by the company, which was a good decision and in line with ANSSI recommendations on the subject). The fifteen-day interruption therefore reflects the time required to restore the system, which is a long time.
  • August: criminals stole approximately $644,000 from a Cypriot shipowner based in Limassol. The company received an email supposedly from an African oil supplier requesting that the payment be sent to a different account than usual. The company complied, only discovering the fraud later.
  • A Mobile Offshore Drilling Unit was infected with malware, affecting the dynamic positioning system and requiring an emergency procedure to avoid an accident.

2014 :

2013 :

2012 :

  • September: under the charming names Sneaky Panda, The Elderwood Gang, and The Beijing Group, one finds the same attempted cyber campaign mainly targeting the United States and, in particular, the naval sector, mainly through spear-phishing.
  • August: oil company Saudi Aramco was hit by the Shamoon malware. The contents of more than 35,000 computers were simply wiped. Five months of rebuilding followed. Unable to invoice the oil leaving its refineries, the company had to let some shipments leave for free. It also caused a temporary hard drive shortage, because it ordered 35,000 of them at once.

2011-2013 :

For two years, traffickers hacked the port of Antwerp and managed to manipulate the container routing system for their own benefit, in order to prevent containers carrying drugs from being inspected by customs.

2011 :

  • 13-14/12/2011: commercial transactions at the port of Rotterdam were halted due to an outage in the Customs information system. Ships could not depart and trucks could not leave the port.
  • 19/09: Japan’s largest defense manufacturer, Mitsubishi Heavy Industries Ltd, was the victim of a cyberattack, which resulted in access to the company’s computers. The company acknowledged in a statement that information may have been stolen. The Yomiuri newspaper reported that 80 computers were infected with malware at the Tokyo headquarters and at design and research facilities, notably the Kobe and Nagasaki shipyards, as well as Nagoya. The Kobe shipyard builds submarines and nuclear plant components, Nagasaki builds surface ships, and Nagoya manufactures missiles and rockets.
  • August: Iranian shipping company IRISL was the victim of a cyberattack. Few details are available, but losses were reportedly substantial, including data loss and financial losses.
  • May: a hacker claimed to have gained access to certain U.S. Navy department servers.

2010 :

  • An oil platform, transferred from its construction site in South Korea to its operating site, was compromised by several malware strains. The platform had to be shut down for 19 days while the malware was handled, and it appears to have affected sensitive systems on board.

2009 :

  • March: a former employee hacked his company’s offshore platforms as retaliation. Damage amounted to thousands of dollars, but fortunately there was no environmental impact.
  • 12/01: the internal network of the French Navy was hit by the Conficker virus. Containing the spread of the malware required several subnetworks to be isolated.

2006 :

2002 :

  • April: a group of hackers calling themselves “Dymanic Duo” managed to break into computer systems belonging to U.S. Navy command, among others. The hackers defaced the U.S. Navy website to demonstrate weaknesses in its security. A defense contractor developing a website for the U.S. Navy shut down its network after the hackers gained access, notably to employee passwords. Pages on that site were also defaced, information was made public, and messages again claimed responsibility under the name “Dynamic Duo.”

1998 :

Updated on 18/05/2020
 APT, Shipowners, MRE, Impacts, Incidents
Back | Home