Cybersecurity for the Maritime sector | Hunt & Hackett

With more than 80% of global trade transported by sea each year, the maritime sector forms a vital link in the global economy.[1] And as the industry embraces digital technologies - integrating IoT technologies, connecting IT and OT systems, and exploring autonomous capabilities - it becomes a bigger target for cyber attacks.

Dutch maritime organizations are at the forefront of this technological evolution. Since the 1980s, the Netherlands has invested heavily in maritime R&D, becoming a global leader in smart shipping and high-tech port infrastructure. But this leadership brings exposure. Threat actors from China, Russia and Iran are well known to target the maritime sector to obtain commercial and/or intellectual advantages, while the Port of Rotterdam lies in the crosshairs of geopolitical conflicts due to its strategic and economic importance.

How can you address this growing threat?

There is this legendary saying on how to overcome your adversaries: 'know thy enemy and know yourself; in a hundred battles, you will never be defeated'. This starts with gaining an understanding of your threat landscape, your adversaries’ intentions, their modus operandi, and specific attacking methods. This page outlines the key threats facing the maritime sector today, along with effective methods for defending against them.

	Maritime	Maritime + related	Broader focus	All known
APTs	94	121	512	801
TTPs	1,674	2,123	3,541	4,112
Attack tools	1,474	1,821	3,027	3,666

Data from Hunt & Hackett’s proprietary Threat Diagnostic System shows a marked increase in cyberattacks targeting the maritime sector in recent years - a trend driven by the industry’s strategic, economic, and geopolitical significance. State-sponsored Advanced Persistent Threats (APTs) target maritime organizations to gain access to critical technologies, intellectual property, and sensitive operational data. These attacks are often part of broader geopolitical strategies, aimed at gaining long-term economic and strategic advantages.

At the same time, the sector’s pivotal role in global trade makes it an appealing target for financially motivated threat actors. Ransomware groups and cybercriminals understand that even short-lived disruptions to port operations or shipping schedules can have massive financial consequences, making maritime organizations particularly vulnerable to extortion-based attacks. Adding to this, hacktivists and other politically motivated actors have turned their attention to the sector in recent years, seeking to disrupt maritime operations to send a political message. Together, these threats not only jeopardize the continuity of global trade but also pose serious risks to the safety of crews at sea.

January 1, 2022
16:00 PM

DDoS attacks on Dutch ports

2023

In June 2023, the websites of major Dutch ports, including Groningen, Amsterdam, Rotterdam, and Den Helder, were taken offline by coordinated Distributed Denial of Service (DDoS) attacks. Claimed by the pro-Russian hacktivist group NoName057(16), the attacks were retaliation against the Netherlands' decision to purchase Swiss tanks for Ukraine as part of the ongoing Russia-Ukraine conflict. The websites were primarily used as a means of informing the public, rather than for port operations, so the impact was negligible. Nonetheless, this incident shows how maritime infrastructure can become caught in the crosshairs of geopolitical conflicts.[2]

January 1, 2022
16:00 PM

Royal Dirkzwager

2023

In March 2023, Dutch maritime logistics company Royal Dirkzwager suffered an attack by Play ransomware group. The attackers encrypted company systems and exfiltrated sensitive customer data, including email addresses and personal information. Although the ransomware caused minimal operational disruption, the stolen data provided significant leverage for ransom negotiations.[3] Royal Dirkzwager, who supports more than 800 maritime organizations with critical logistical information, publicly apologized for the breach and subsequently implemented enhanced security measures, including Endpoint Detection and Response (EDR) software, to prevent future incidents.[4]

January 1, 2022
16:00 PM

Stena Impero

2019

In July 2019, a UK-flagged product tanker called the Stena Impero was seized by Iranian forces in the Strait of Hormuz after allegedly veering into Iranian waters. Investigations later indicated the vessel's Automatic Identification System (AIS) - used to track ship positions and movements - may have been spoofed, a technique used to manipulate the GPS capabilities of vessels. The incident occurred just 15 days after the British Navy detained the Iranian tanker Grace 1 near Gibraltar and was widely seen as retaliation. While Iran denied tampering with the AIS, this case shows how GPS interference can be used by states to gain geopolitical leverage against their adversaries. Given the fact that AIS spoofing is a relatively low-tech, inexpensive endeavor, it is likely that this tactic will only grow in popularity, particularly as global tensions heighten.[5]

January 1, 2022
16:00 PM

Maersk

2017

In 2017, shipping giant Maersk suffered one of the most significant cyber incidents ever to hit the maritime industry. The NotPetya attack, which initially targeted Ukrainian entities, spread globally through compromised software, claiming victims in more than 60 countries. Maersk was among the hardest hit, losing an enormous chunk of its IT infrastructure thanks to the wiper malware’s destructive capabilities. In fact, the company reported the loss of over 49,000 end-user devices and 1,000 business applications, resulting in damages exceeding $300 million.[6] The attack was eventually attributed to the Russian APT Sandworm, who were working to sabotage and disrupt key Ukrainian entities due to geopolitical tensions between Russia and Ukraine.[7] It appeared that Maersk – like the vast majority of NotPetya's victims – was simply collateral damage. Nonetheless, the impact of this incident was enormous, highlighting the vulnerability of even the industry’s largest, most well-resourced players.

Digitalization introduces new risks for OT systems

Low frequency, high impact

Delayed awareness and maturity

Many companies in the maritime sector fall under the scope of the NIS2 Directive as Essential or Important entities. Organizations are expected to address several important aspects of cybersecurity, as outlined in Article 21(2) of the Directive, including:

Awareness of your threat landscape and a data-driven security roadmap
Risk analysis and security policies to safeguard information systems
Incident handling and business continuity to ensure resilience and recovery
Forensic readiness and the ability to perform a root cause analysis
Supply chain and system security for robust protection and secure development

Hunt & Hackett’s Managed Detection and Response (MDR) solution directly aligns with several of the Directive’s key requirements, including the 24-, 72-, and one month incident reporting timelines, forensic readiness requirements, and risk management preparation. Read on to discover the core features of our service.

Additionally, we've developed a practical assessment framework that aligns NIS2 requirements with established cybersecurity standards, including ISO/IEC 27001:2022, ISO/IEC 27002:2022, and CIS controls. Although exact NIS2 requirements are evolving, our standards-based approach provides a robust foundation to benchmark your current cybersecurity measures and pinpoint areas for improvement.

To defend against this threat landscape, it is equally important to gain critical insights into the current resilience level of your organization. To understand thyself it is useful to let (third-party) security specialists assess your defenses and simulate meaningful attacks. When done right, such an approach provides critical insights into the resilience level of the organization against its threat landscape. Hunt & Hackett use its proprietary threat modelling-based approach with its clients in the manufacturing sector to provide meaningful insights as well as tailored solutions for the strategic, tactical, and operational aspects of their cybersecurity program.

In their fight against cyber attacks, our customers typically go through several stages of maturity. By ramping up their prevention, detection and incident readiness over time – and optimizing this for their actual threat landscape – they reach a point where they have developed solid resilience against targeted attacks, with only highly controlled and accepted risks remaining.

There is no simple 'fix' to become resilient against the sophisticated cyber threats of today. Without serious resources or processes for systematic security activities, protection against modern cyber threats like ransomware is just a wish. Hunt & Hackett has developed a unique threat- and sector-driven approach to cybersecurity, enabling you to work from your current situation to a highly improved and controlled situation, optimized for your specific threat landscape and context as an organisation.

Schietschijven1

STAGE 1: Unknown risk
Pre-monitoring
-

Preventitive controls

Limited resilience

Schietschijven2-1

STAGE 2: Reduced risk
Post-monitoring
-

Preventitive CIS controls (IG1)

Detection & response controls

Resilience against non-targeted attacks

Schietschijven3

STAGE 3: Controlled risk
Implemented roadmap
-

Alignment between preventitive, detection & response CIS controls (IG2)

Resilience against non-targeted and semi-targeted attacks

Schietschijven4

STAGE 4: Highly controlled risk
Targeted attack resilience
-

Full redundancy between preventitve, detection & response CIS controls (IG3)

Resilience against against advanced targeted attacks