Cybersecurity for the Maritime sector

Dutch ports have been caught in the crosshairs of pro-Russia hacktivist attacks conducted in retaliation for military or diplomatic support given to Ukraine. In the EU's 2025 threat landscape for transport and ports, nearly 88% of incidents were hacktivist-driven DDoS attacks, often timed with political events.[31][5] 

The pressure goes beyond disruption. Dutch intelligence services assess that Russia is carrying out cyber operations against Dutch public institutions, critical infrastructure and laying the groundwork for sabotage. They also warn that Russia is mapping seabed infrastructure and conducting maritime espionage – which could later support sabotage - and that Europe has seen a sharp rise in such activity since late 2023. Ports are exposed because most are commercially operated yet serve military logistics functions, which makes them attractive hybrid-warfare targets.[14][16] 

The supply chain is the most sensitive target in the maritime ecosystem, because port operations alone can involve hundreds or thousands of companies. An incident at one party can have consequences for the entire chain. Small and medium-sized companies in particular often lack the resources or knowledge to protect themselves. In the Netherlands, growing dependence on a few software suppliers is a recognized risk, since technical or human errors have already caused major disruptions. The Port of Rotterdam Authority also warns against excessive reliance on American cloud providers.[10][33][34][35]

Vendors that serve ports and carriers often hold years of support correspondence, EDI configurations, billing data and user lists, so one compromised support environment can expose many customers whose own networks were never touched. On ships, remote vendor access is consistently identified as the largest practical exposure: engine makers, ECDIS suppliers and automation vendors connect for diagnostics, often through arrangements nobody in the shipowner's organization has documented.[30][36]

Operational Technology (OT) systems, which control crucial physical processes aboard ships and within ports - such as propulsion systems, cargo handling, and navigation - have emerged as attractive targets for cyber attackers. Between 2017 and 2020 alone, cyberattacks on maritime OT systems skyrocketed by 900%, and these attacks have only become more prevalent in the years since. 

One of the biggest challenges in securing maritime OT environments is the longevity and diversity of ship equipment. Typically, vessels remain operational for 25-35 years, and updates are done on different pieces of equipment at varying time intervals. Consequently, many OT systems remain unpatched and vulnerable, having been designed in an era when cybersecurity was not a primary concern. 

Adding complexity, the maritime sector is rapidly adopting Internet of Things (IoT) technologies to enhance connectivity and collect real-time operational data. Such developments are essential for innovations such as autonomous shipping. However, this increasing digital interconnectivity inadvertently bridges IT and OT networks, amplifying security risks and expanding the potential attack surface.  

Complicating matters, maritime operators often face a limited understanding and oversight of their full network and device inventory across fleets and operations. This lack of visibility can lead to hidden vulnerabilities, creating ideal conditions for threat actors seeking to exploit operational weaknesses and disrupt critical maritime functions.[34][43] 

Recorded attacks on shipping rose from 10 in 2021 to at least 64 in 2024 in research by a Dutch university of applied sciences, and recorded maritime cyber incidents jumped 103% during 2025, with infected USB devices among the main routes for introducing remote-access malware onto bridge systems. In the EU's 2026 threat landscape, transport accounted for 8% of all recorded cyber events, and water transport for 16.4% of transport-sector incidents.[4][13] 

Ransomware is less frequent than hacktivist DDoS but remains the most damaging in downtime and cost, and criminals increasingly threaten to publish sensitive data when victims refuse to pay. In the Netherlands, more than 170 ransomware attacks took place in 2023, a considerable share against mid-sized companies. Worldwide, ransomware incidents affecting industrial entities rose to 1,211 in the fourth quarter of 2025, up from 742 in the third, and those affecting transportation organizations rose from 36 to 120 over the same period.[34][5][9] 

Maritime is still viewed as a relatively immature sector for cybersecurity, and it has been placed in the risk zone of the EU's NIS360 review for below-average cyber maturity. Some operators run mature programs, but many struggle to keep pace, mainly because new IT and OT technologies have been layered onto legacy infrastructure without comprehensive asset inventories. Recovery is also slower than often assumed.[15][12][4][11] 

The sector is responding collectively. Dutch seaport operators, the Ministry of Infrastructure and Water Management and the NCTV have agreed a joint approach in the Cyber Strategy for Dutch Seaports, and updated IACS cyber requirements for ships (UR E26 and E27) apply to new ships contracted for construction from 1 July 2024. Access to threat information remains uneven, however: at the Port of Rotterdam only a handful of companies are designated as vital by the government, and only those have access to it, which the port authority considers worrying given rising digital connectedness.[2][37][35]