INDUSTRY FACT FILE · MARITIME, PORTS & SHIPPING

Threat Landscape: Top Cyber Threats Facing Maritime, Ports and Shipping

The 18 most relevant cyber threats, attacks and industry challenges for ports, terminal operators, shipping companies, shipyards and waterway operators, and the impact each one has on trade, safety, revenue and customers.

Ports and shipping companies attract ransomware groups because cargo cannot wait and the pressure to pay is public; state-backed actors because ports are strategic infrastructure and shipyards hold naval designs; fraudsters because delivery orders, truck nominations and settlements move high-value goods and money; and opportunists because ships, cranes and gates run legacy systems reachable through OEM links. The attack surface spans terminal OT, TOS and PCS integrations, customer portals, ship bridge and engine-room systems, satcom and the office IT that connects them all.

Landmark incidents show the pattern. NotPetya (2017) destroyed Maersk's network and cost US$250–300 million. Shahid Rajaee (2020) saw road and shipping queues after a cyber attack. Nagoya (2023) lost two days of container operations to LockBit ransomware delivered through its unified terminal system. DP World Australia (2023) disconnected four terminals and stranded about 30,000 containers after data theft. Seattle (2024) refused a US$6 million Rhysida ransom while airport and marina systems were down. A suspected ransomware incident at a Jawaharlal Nehru Port terminal in 2022 forced vessel diversions, and UKMTO advisories in 2025 reported GNSS interference across the Gulf and Red Sea.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by maritime and port segment (Codec Networks assessment).

4.1 Ransomware and the terminal that cannot see its yard

Nagoya and DP World Australia show that when the cargo system goes, the terminal stops even with every crane intact. Backups on the same network and untested restores turn hours into weeks.

• Questions to test: Are TOS, gate and OT networks separated from office IT? Are backups immutable and restore times proven? Are EDR alerts watched 24x7? Is there a manual yard and gate playbook?
• Relevant services: segmentation, backup and recovery testing, continuity playbooks, EDR and SOC.

4.2 OEMs, vendors and remote access

Crane, gate and navigation OEMs keep standing links with shared credentials; integrators and dredging contractors bring devices onto port networks; ships receive updates by satcom and USB.

• Questions to test: Which vendors can reach OT and cargo systems, and is access brokered and recorded? Are contractor devices scanned and segmented? Are ship updates controlled?
• Relevant services: remote access brokering, third-party programme, device controls, access recertification.

4.3 Cargo platforms and release fraud

PCS and TOS portals, delivery orders and truck nominations are the keys to high-value cargo. Weak authentication and missing anomaly checks make theft look like a normal release.

• Questions to test: Do all trade users have MFA? Are APIs tested for authorisation flaws? Are delivery-order changes and nominations monitored? Is high-value release verified?
• Relevant services: portal and API testing, fraud analytics, release verification, partner awareness.

4.4 Ships, navigation and the IMO regime

GNSS spoofing in the Gulf and Red Sea, malware on bridge and engine-room systems and remote access from shore make ship cyber a safety matter that flag, class and charterers now inspect.

• Questions to test: Does each ship's SMS address cyber risk as MSC.428(98) requires? Are newbuilds specified to UR E26/E27? Are GNSS integrity checks and degraded-navigation drills in place?
• Relevant services: ship cyber risk assessments, UR E26/E27 readiness, bridge procedures and drills.

4.5 Detection, reporting and the 6-hour clock

CERT-In requires reporting within six hours; NCIIPC expects protected-system owners to report; listed groups disclose quarterly; customers and customs expect answers. Terminals, ships and OEM sessions are usually unmonitored.

• Questions to test: Are terminals, ports and fleets monitored 24x7? Do we see OEM sessions? Is there a playbook combining safety decisions, manual operation, CERT-In reporting, customer and customs communication?
• Relevant services: IT/OT SOC, playbooks, joint drills with operations, customers and customs.

• CERT-In: incidents reported within six hours of noticing them.
• NCIIPC: incidents affecting notified protected systems require coordination and reporting.
• DG Shipping, flag and class: ship incidents affecting safety management engage ISM audits, port state control and class surveys; port facility incidents engage ISPS plans.
• Customs and customers: cargo release and documentation incidents trigger customs inquiries and contractual notifications.
• SEBI LODR: listed operators disclose cyber incidents quarterly.
• DPDP and insurers: customer, crew and driver data incidents trigger breach intimation from May 2027; insurers and P&I clubs require prompt notice.

• If our TOS and gate systems went dark, could we run the yard and release cargo safely?
• Which OEMs, contractors and ships can reach our control and cargo networks, and is that access brokered and recorded?
• Could a stolen portal login release a container to the wrong truck?
• Does every ship's safety management system address cyber risk, and are our newbuilds specified to UR E26/E27?
• Do we have offline backups of TOS, PLC configurations and ERP with proven restore times?
• Could we detect, contain and report an incident within six hours while keeping ships, crews and terminals safe?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events and company disclosures.