What does a maritime cyber incident cost?
Recently a researcher wrote about me, behind the paywall of an academic paper, without consulting me or offering a right of reply, that when I spoke up it was to praise the resilience of the maritime sector and to argue that attacks on it are impossible. For someone who has worked on the subject for more than 25 years, who started this blog in 2017 (when maritime cyber was still of no interest to anyone), who built the first global database of maritime cybersecurity incidents more than five years ago, and who describes part of it here, you will find that as funny as I do.
To those researchers, if you have a minimum of ethics and consideration, allow me only the freedom not to fan the flames when an incident happens, and to avoid on those occasions, out of modesty or out of ethics, reaching every time for the “I told you so” or the “if you need me, I am here”.
Yes, the sector knows how to be resilient. It is in its DNA. It does not always work. Yes, some types, some generations and some installations aboard ships or in ports are barely exposed to cyber threats, and the risk there is contained.
Should we congratulate ourselves and settle for a pat on the back? No.
Conversely, saying that the whole sector is highly vulnerable, or making sweeping statements… is probably not desirable either: every ship and every port is different. Anyway, let us move on.
The question that follows is one I am often and quite legitimately asked: leaving aside the well known Maersk case, what does a cyberattack cost the sector? I usually answer by separating out the financial items involved, because one incident can produce several bills:
- incident response costs,
- rebuilding and then hardening the information systems,
- lost customers,
- higher insurance premiums,
- communications costs,
- fines…
The cost also depends on what the company does, and therefore on its operations, and on the type of attack it suffered: state-sponsored attack, ransomware, hacktivism, payment fraud through business email compromise (BEC), these four families do not leave the same accounting trace. Here are some figures.
The dataset
The dataset I use covers 4,276 incidents between 1980 and 2026, in 165 countries and across twenty activities of the sector, with 337 actors and 116 malware families identified, and 344 campaigns reconstructed. It cites 8,075 references, dates 93.8% of its entries to the day, geolocates 95.4% of them, and rates each one under the Admiralty system, which scores source reliability and information credibility separately. The figures below are as at 28 September 2026.
Like any dataset, mine carries biases too. Its main bias is structural: this count rests on public sources only. A victim who settles its incident with its insurer and its lawyer, without ever saying a word in public, does not appear in it, and its amount even less so. Countries with a dense specialist press and mandatory disclosure weigh more heavily than the others, which explains much of the place the United States holds in the amounts below. The figures given here are therefore a floor, never an estimate of the real cost borne by the sector.
That much is said.
The share of incidents with a figure
Of those 4,276 incidents, 84 carry an amount, or 2.0%, for 89 recorded amounts, since one incident can carry two when a ransom demand precedes a disclosed loss. An amount is recorded only when a reliable source attributes it to that victim and that incident. That 2.0% measures what has been published, and nothing else.
The spread of those 84 incidents does not follow the volume of attacks: the cost of the event is rarely available for a denial of service, and hardly more so for ransomware. And, save for particular regulatory situations, the amounts only surface years later.
State-sponsored attacks
Three incidents out of 85 attributed to a state carry an amount, and each of the three was costed by a third party that had to do it, such as the auditor of a listed group or the yard in charge of the repair. The Maersk case, 300 million dollars, comes out of the financial report of a listed group, while the overall impact of the same attack has several times been put, for United States companies alone, at more than a billion dollars. The other two are repairs to subsea infrastructure: a damaged gas pipeline in the Baltic Sea (= not cyber), whose repair approaches 300 million euros, and a submarine telecommunications cable cut between two East Asian islands, 570,000 dollars.
Ransomware
Ransomware is twelve times more frequent than state-sponsored attacks in this dataset, and barely better documented. Out of 1,015 incidents, only 24 carry an amount, or 2.4%. Three of them carry two, a ransom demand followed by the price at which the stolen data was later put up for sale, or followed by the sum actually paid, which makes 27 amounts in all. Of those 27, 21 are set by the attacker and 6 are borne by the victim. The demands run from 4,000 dollars, addressed to a small French marine energy company, to 60 million addressed to a North American insurer that paid 40. The median demand reaches 1.5 million dollars, across the 17 demands a source states in, or converts to, dollars.
Ransom amounts are generally set according to the victim’s financial standing, and so that the demand remains “acceptable” to it. Several groups work theirs out as a percentage of the turnover they read off a company directory, and the damage suffered counts for nothing in that calculation. Only five cases carry a real loss, all of them in organisations required to publish. A listed boating manufacturer reports 85 million dollars, an oilfield services provider 35 million, an electronic components maker 21.4 million. For an inland port in the western United States or a ship repair yard, no such document exists. The cost of the shutdown often stays unknown even when the incident itself is public.
Hacktivist claims
The gap is wider still in the largest family of all. One amount across 2,419 incidents, and it comes from the attacker: 100,000 dollars asked by a group for personnel data from a navy. No victim in this family has published a loss, and the 2,361 denial of service events recorded carry no documented cost.
The explanation lies in the nature of the harm. A few hours of downtime on a public website trigger no invoiced restoration and no insurance claim. What remains is the claim of responsibility, which carries no figure. Measuring the real effect of these campaigns calls for a separate instrument, an independent read-only probe against the announced targets, whose results I described in a method article.
Payment fraud
Then comes the family that gets talked about least: payment fraud, the fake transfer order or business email compromise. It is nonetheless the one we have the most figures on. Indeed, 42 fraud incidents out of 235 carry an amount, or 17.9%, seven times the ransomware rate.
A diverted transfer is a single exact number, one that accounting has to reconcile, that an insurer has to handle, that a judge can order to be returned. 30 of those losses are stated in dollars or converted by a source. The median stands at 374,000 dollars and 23 of the 30 stay below the million. The range runs from 7,300 euros for an interior fit-out supply to 18 million for a bunker supplier. That is the order of magnitude a shipping agency, a broker or a mid-sized yard absorbs in its yearly result. The vector has been documented as routine for a long time, including in United States Coast Guard bulletins. So are the measures that stop it, which the FBI’s Internet Crime Complaint Center sets out for companies, starting with verification of any change of banking details through a separate channel [1].
The items one can separate
That leaves the question opened by the list of items at the top of this article, what an incident finally costs the party that suffered it. Answering it means knowing how a total is made up, and the dataset almost always records the total, rarely its composition. Rebuilding the information system can be read in a handful of cases, lost revenue in three, incident response in nine, notification of the people concerned in twenty-five.
Two files give both ends of the chain, from the transfer that left to the charge booked in the accounts. A Canadian bulk terminal sees 6.2 million Canadian dollars leave in four transfers. It files a civil claim, obtains a default judgment, notifies its insurer, and finally books 2.6 million as a charge in its first quarter report. A United States port authority pays 16,666 dollars to a fraudulent supplier, recovers 14,166 through its insurance, and keeps 2,500 dollars as a net loss, which is its deductible. The amount diverted and the final cost are two distinct numbers: the terminal keeps 42% of what left, the port authority 15%.
Fines, the last item on my list, are the most erratic variable. The dataset holds three. A cruise operator pays 1.25 million dollars before the financial regulator of a United States state. An offshore vessel owner pays 18,000 Singapore dollars. A Korean shipyard, after a theft of hull plans, pays 4.8 million won, about 3,400 dollars. No common scale connects those three penalties.
All told, the 67 amounts a source states in, or converts to, dollars span five orders of magnitude, and they do not measure the same thing depending on which line they sit on. A disclosed loss comes out of the victim’s accounts, a ransom demand and a data price come off the attacker’s page.
Taking stock
The two largest amounts in this dataset have no attacker at all. Both are information system malfunctions. A Swedish roll-on roll-off ferry capsizes in June 1980 off Cyprus, a few days after delivery, on an error in the ballast software: 200 million pounds of cargo on the seabed. A United States Navy vessel grounds in January 2013 on a protected reef in the Philippines, the electronic chart placing the obstacle some 15 km (8 nautical miles) from its real position; removing the hull will cost 277 million dollars.
So yes, a cyberattack costs the maritime sector, and no single figure sums that cost up. The one we know how to document at scale is the diverted transfer, a few hundred thousand dollars each time, in a family of attacks that rarely makes the headlines. The cost of downtime can only be read at listed companies. No flag state today requires anyone to declare what a cyber incident cost, and the most complete accounts in the sector sit with the insurers, who do not publish them.
Sources
- Business Email Compromise, Internet Crime Complaint Center, Federal Bureau of Investigation, accessed 27 September 2026.
