What does a maritime cyber incident cost?
This article is also available in French.
Leaving aside the well known Maersk case, what does a cyberattack cost the maritime sector? The question comes up often, and legitimately. I usually answer by separating out the financial items involved, because one incident can produce several bills: incident response, rebuilding and then hardening the information systems, lost customers, higher insurance premiums, communications costs and fines.
The cost also depends on what the company does, and therefore on its operations, and on the type of attack it suffered: state-sponsored attack, ransomware, hacktivism, payment fraud through business email compromise (BEC), these four families do not leave the same accounting trace. Here are some figures.
The dataset
The dataset I use covers 4,601 incidents between 1980 and 2026, in 165 countries and across twenty activities of the sector, with 350 actors and 115 malware families identified, and 354 campaigns reconstructed. It cites 8,699 references, dates 93.0% of its entries to the day, geolocates 94.8% of them, and rates each one under the Admiralty system, which scores source reliability and information credibility separately. The figures below are as at 14 October 2026.
Like any dataset, mine carries biases too. Its main bias is structural: this count rests on public sources only. A victim who settles its incident with its insurer and its lawyer, without ever saying a word in public, does not appear in it, and its amount even less so. Countries with a dense specialist press and mandatory disclosure weigh more heavily than the others, which explains much of the place the United States holds in the amounts below. The figures given here are therefore a floor, never an estimate of the real cost borne by the sector.
That much is said.
The share of incidents with a figure
Of those 4,601 incidents, 105 carry an amount, or 2.3%, for 110 recorded amounts, since one incident can carry two when a ransom demand precedes a disclosed loss. An amount is recorded only when a reliable source attributes it to that victim and that incident. That 2.3% measures what has been published, and nothing else.
The spread of those 105 incidents does not follow the volume of attacks: the cost of the event is rarely available for a denial of service, and hardly more so for ransomware. And, save for particular regulatory situations, the amounts only surface years later.
State-sponsored attacks
Three incidents out of 86 attributed to a state carry an amount, and each of the three was costed by a third party that had to do it, such as the auditor of a listed group or the yard in charge of the repair. The Maersk case, 200 to 300 million dollars, comes out of the interim financial report of a listed group [1], while the overall impact of the same attack has several times been put, for United States companies alone, at more than a billion dollars. The other two are repairs to subsea infrastructure: a gas pipeline damaged in the Baltic Sea by an anchor (no cyber origin), whose repair cost about 35 million euros [2], and a submarine telecommunications cable cut between two East Asian islands, 570,000 dollars.
Ransomware
Ransomware is twelve times more frequent than state-sponsored attacks in this dataset, and barely better documented. Out of 1,080 incidents, only 26 carry an amount, or 2.4%. Three of them carry two, a ransom demand followed by the price at which the stolen data was later put up for sale, or followed by the sum actually paid, which makes 29 amounts in all. Of those 29, 23 are set by the attacker and 6 are borne by the victim. The demands run from 4,000 dollars, addressed to a small French marine energy company, to 60 million addressed to a North American insurer that paid 40. The median demand reaches 1.5 million dollars, across the 19 demands a source states in, or converts to, dollars.
Ransom amounts are generally set according to the victim’s financial standing, and so that the demand remains “acceptable” to it. Several groups work theirs out as a percentage of the turnover they read off a company directory, and the damage suffered counts for nothing in that calculation. Only five cases carry a real loss, all of them in organisations required to publish. A listed boating manufacturer reports 85 million dollars, an oilfield services provider 35 million, an electronic components maker 21.4 million. For an inland port in the western United States or a ship repair yard, no such document exists. The cost of the shutdown often stays unknown even when the incident itself is public.
Hacktivist claims
The gap is wider still in the largest family of all. One amount across 2,528 incidents, and it comes from the attacker: 100,000 dollars asked by a group for personnel data from a navy. No victim in this family has published a loss, and the 2,449 denial of service events recorded carry no documented cost.
The explanation lies in the nature of the harm. A few hours of downtime on a public website trigger no invoiced restoration and no insurance claim. What remains is the claim of responsibility, which carries no figure. Measuring the real effect of these campaigns calls for a separate instrument, an independent read-only probe against the announced targets, whose results I described in a method article.
Payment fraud
Then comes the family that gets talked about least: payment fraud, the fake transfer order or business email compromise. It is nonetheless the one we have the most figures on. Indeed, 60 fraud incidents out of 339 carry an amount, or 17.7%, seven times the ransomware rate.
A diverted transfer is a single exact number, one that accounting has to reconcile, that an insurer has to handle, that a judge can order to be returned. 40 of those losses are stated in dollars or converted by a source. The median stands at 308,000 dollars and 30 of the 40 stay below the million. The range runs from 7,300 euros for an interior fit-out supply to 18 million for a bunker supplier. That is the order of magnitude a shipping agency, a broker or a mid-sized yard absorbs in its yearly result. The vector has been documented as routine for a long time, including in United States Coast Guard bulletins. So are the measures that stop it, which the FBI’s Internet Crime Complaint Center sets out for companies, starting with verification of any change of banking details through a separate channel [3].
The items one can separate
That leaves the question opened by the items listed at the top of this article, what an incident finally costs the party that suffered it. Answering it means knowing how a total is made up, and the dataset almost always records the total, rarely its composition. Rebuilding the information system can be read in a handful of cases, lost revenue in three, incident response in nine, notification of the people concerned in twenty-five.
Two files give both ends of the chain, from the transfer that left to the charge booked in the accounts. A Canadian bulk terminal sees 6.2 million Canadian dollars leave in four transfers. It files a civil claim, obtains a default judgment, notifies its insurer, and finally books 2.6 million as a charge in its first quarter report. A United States port authority pays 16,666 dollars to a fraudulent supplier, recovers 14,166 through its insurance, and keeps 2,500 dollars as a net loss, which is its deductible. The amount diverted and the final cost are two distinct numbers: the terminal keeps 42% of what left, the port authority 15%.
Fines, the last item on my list, are the most erratic variable. The dataset holds three. A cruise operator pays 1.25 million dollars before the financial regulator of a United States state. An offshore vessel owner pays 18,000 Singapore dollars. A Korean shipyard, after a theft of hull plans, pays 4.8 million won, about 3,400 dollars. No common scale connects those three penalties.
All told, the 80 amounts a source states in, or converts to, dollars span five orders of magnitude, and they do not measure the same thing depending on which line they sit on. A disclosed loss comes out of the victim’s accounts, a ransom demand and a data price come off the attacker’s page.
Taking stock
Leaving Maersk aside, the two largest amounts in this dataset have no attacker at all. Both are information system malfunctions. A Swedish roll-on roll-off ferry capsizes in June 1980 off Cyprus, a few days after delivery, on an error in the ballast software: 200 million pounds of cargo on the seabed. A United States Navy vessel grounds in January 2013 on a protected reef in the Philippines, the electronic chart placing the obstacle some 15 km (8 nautical miles) from its real position [4]; removing the hull will cost 277 million dollars.
So yes, a cyberattack costs the maritime sector, and no single figure sums that cost up. The one we know how to document at scale is the diverted transfer, a few hundred thousand dollars each time, in a family of attacks that rarely makes the headlines. The cost of downtime can only be read at listed companies. No flag state today requires anyone to declare what a cyber incident cost, and the most complete accounts in the sector sit with the insurers, who do not publish them.
Sources
- Maersk says NotPetya cyberattack could cost $300 million, CNBC, 16 August 2017, accessed 27 October 2026.
- €35 million Balticconnector gas pipeline repair work finished, ERR News, 2024, accessed 27 October 2026.
- Business Email Compromise, Internet Crime Complaint Center, Federal Bureau of Investigation, accessed 27 September 2026.
- Untold Tale Behind USS Guardian Reef Grounding: NGA’s Map Was Wrong By 8 Miles, Breaking Defense, July 2013, accessed 27 October 2026.
Figures updated on 14/10/2026.
