Maritime cybersecurity 2024 in numbers

716 maritime cyber incidents recorded in 2024, against 117 two years earlier. Almost all of that growth comes from a single mode of action, noisy and industrialised, which hardly ever touches operations. Behind that curtain, ransomware kept advancing among the sector’s suppliers, and two submarine cables were severed in the Baltic by merchant ships.

This article is also available in French.

Figures and charts as of 7 September 2026.

These figures come from my research dataset on maritime cyber incidents, built during my doctorate and kept up since with my own means alone. It records only what came out publicly, and most often through the attacker’s voice. Read it as an indicator of pressure; nobody holds the full inventory.

The volume has changed order of magnitude

The rise is continuous: 91 records in 2021, 117 in 2022, 529 in 2023, 716 in 2024. The counter has been multiplied by six in two years. And 2025 did not slow down: the year closed at 1,295 records.

Measured against 2023 alone, the rise is 35%, and it spreads unevenly. Denial of service grows 32%, from 401 to 531 records, while ransomware gains 29%, from 95 to 123. The noise is therefore growing slightly faster than the threat that costs money. Data leaks go from 7 to 19 records: a spectacular variation in proportion, on numbers too small to draw anything from.

This change of scale measures the settling in of a heavily industrialised mode of action, one that produces volume at almost no cost.

One group alone accounts for half the year

Of the 716 records, 531 fall under distributed denial of service (DDoS), close to three in four, almost all hacktivist in origin. The pro-Russian ecosystem NoName057(16) carries 482 of them on its own: 67% of everything I recorded in the year, and close to nine DDoS out of ten.

Its target of choice remains the port, with 171 records, ahead of maritime administrations and defence players. Its geography follows political news rather than maritime activity: Spain comes far ahead with 82 records, then Sweden (32) and Italy (31), then Germany and Ukraine (30 each). The July peak, 86 incidents in the month, looks like every wave of its kind: a few days of attacks concentrated on one country, after a statement or a summit.

Compared with 2023, the group grows by 32%, from 366 to 482 records, slightly more slowly than the year’s total: its dominance holds without extending. Its map, on the other hand, is entirely redrawn. Spain goes from 14 to 82 records for this group alone, Japan from 1 to 26, while Italy falls from 43 to 31 and Finland from 30 to 15. At basin level and across all incidents, the Mediterranean gains 77%, from 113 to 200 records, while the Baltic loses 21%, from 203 to 161. The pressure moves south.

The operational effect, though, stays small. A DDoS makes a website or a portal unreachable for a few hours and reaches neither the terminal nor the ship. Its real cost is the attention it takes up: watching these alerts go by, you end up no longer looking at the rest.

Ransomware settles in among suppliers

123 records in 2024, one incident in six, against 95 the previous year. The United States concentrates 50 of them, two in five. And the split by trade says more than the total: 34 among manufacturers and equipment suppliers, 20 among shipowners, 14 among logisticians, 14 in ports, 12 offshore. The year-on-year movement says more than the snapshot: among manufacturers alone, ransomware goes from 16 to 34 records, up 113%, and from 8 to 14 in ports, while logisticians edge down from 16 to 14. In the United States, the number of ransomware victims triples, from 17 to 50. These groups have no particular appetite for the maritime sector: they take what is vulnerable and reachable, and part of the sector happens to be in their path. What falls sits on the periphery of the ship, with those who build it, equip it and supply it.

No group dominates this category: Play and RansomHub at 16 records, LockBit at 10, then a long tail of affiliates. The ecosystem runs on subcontracting: the disappearance of a brand does not reduce the number of attacks.

The example of the year is the Port of Seattle, encrypted in late August 2024 by the Rhysida ransomware. The port authority, which also runs Seattle-Tacoma International Airport, disconnected its systems from the internet; check-in, baggage handling, kiosks, display boards and parking reservation went down, and staff went back to dry-erase boards. It refused to pay the ransom of roughly six million dollars, explaining publicly that it was handling public money [1]. The stolen data was eventually published, and the port notified nearly 90,000 people, mostly staff and contractors [2]. We find here what we had already seen at Norwegian cruise operator Hurtigruten: operations carry on after a fashion, the back office gives way.

The Baltic cables enter the picture

Four records from 2024 concern damage to subsea infrastructure. None of them is a computer attack. I keep them in the same dataset all the same, because these are the very links that carry the sector’s communications, and because the suspected authors are the same ones found behind the rest.

On 17 and 18 November 2024, the bulk carrier Yi Peng 3, Chinese-flagged and under a Russian master, left the Russian port of Ust-Luga and severed two links one after the other: the BCS East-West Interlink between Lithuania and Gotland, then C-Lion 1, the only direct submarine cable between Finland and Western Europe, some 700 kilometres (380 NM) from Helsinki [3]. The vessel had dragged its anchor. It then lay at anchor for several weeks in the Kattegat under international surveillance, received a delegation of investigators from five countries on board, and put back to sea without being seized or charged [4]. On 25 December, the tanker Eagle S damaged the Estlink 2 power link in the Gulf of Finland in its turn.

On attribution, caution remains in order. Several European officials spoke of sabotage, and the American press reported, from anonymous intelligence sources, that the master had acted on Russian instructions [5]; other assessments, American as well, did not conclude the cuts were deliberate. To this day, no state has formally attributed them. The demonstration, though, is established: an anchor and a bulk carrier are enough to cut a strategic link, at no cost and with next to no legal risk either. This is the kind of subject that critical infrastructure resilience legislation will have to take head-on.

And what about GNSS?

Four records only in 2024, which says nothing about the real scale of the phenomenon. Jamming has become so routine in the Persian Gulf, the eastern Mediterranean and the Black Sea that it is no longer reported case by case. Assume instead that, in those areas, the position and time given by satellite networks are not reliable. And beware of stories that are too neat: I have already explained why one should wait for the investigation reports before concluding spoofing in the face of a collision.

The noise, the supplier and the cable

Three movements stand out from the year, and none of them is settled with the same tools.

Hacktivist noise occupies the ground, close to three incidents in four, and a single group produces most of it. It is handled with anti-DDoS protection, a communication procedure, and the composure not to convene a crisis cell at every claim.

Ransomware, for its part, has moved towards suppliers. The scenario to prepare for is no longer only “my system is encrypted”, it is “my shipping agent has been unreachable for ten days and my port calls are piling up”. That is handled through contractual requirements, an inventory of dependencies, and tested backups. The vulnerabilities exploited are nothing exotic: exposed remote access, missing multi-factor authentication, late patching, end-of-life hardware. The United States Coast Guard and CISA say nothing else when they go fishing for vulnerabilities in ports.

The cable, finally, is a matter of link redundancy and of the ability to hold when links go down. For a shipowner or a port, the question fits in one sentence: what happens if the main link disappears for ten days, and who has tested it?

Sources

• [1] Cybersecurity Dive, Port of Seattle refuses to pay the Rhysida ransom (September 2024)
• [2] Port of Seattle, notice to individuals affected by the fall 2024 cyberattack
• [3] Cinia, a fault in the C-Lion1 submarine cable between Finland and Germany (November 2024)
• [4] CNN, accident or sabotage: American and European officials disagree over the cut undersea cables (November 2024)
• [5] gCaptain, Russia now primary suspect in the Yi Peng 3 Baltic Sea cable incident (December 2024)