Cyber-attack on vessel

An oil tanker operated by one of our Members suffered a cybersecurity incident in which the operating systems and stored data on multiple work PCs connected to vessel’s onboard server, were deleted, and the ship’s external email communication and vessel management programs were disrupted. The incident occurred on a passage from Egypt to Galveston, Texas.

The vessel was subsequently boarded by the American Coastguard and the FBI, with consequent additional delay and negative publicity.

The detailed learnings from the incident may form part of other IMCA publications. 

The nature of the damage was consistent with Wiper-type attacks, which focus on system destruction rather than financial demands. Following the incident, the attacker sent mocking emails containing political and ideological statements and claiming to have seized control of the vessel. The vessel and the company convened their emergency response teams, isolated PCs and servers suspected of being infected from the network, and changed the public IP address and the business network’s IP range. They restored the vessel’s operating system and data on the server as well as the email service, recovered a backup, and formatted and reinstalled the infected PCs. No abnormalities were found during inspections of key OT systems; therefore, the actual damage was assessed to be limited to the IT business network.

However, at the time of the incident, there were no additional security devices directly managed by the company beyond the telecom provider’s firewall; long-term log retention was limited; and a licensing structure that made it difficult to update the firewall firmware was identified. Furthermore, the fact that destructive activities spread to PCs connected via the LAN after the server or accounts were compromised suggests that the internal barriers within the business network—including segmentation, access control, behaviour-based detection, and privilege management—may not have been sufficient.

At this stage, the initial point of entry has not been confirmed. However, it was reported that the affected vessel lacked a sufficiently up-to-date communications and security environment; the existing VSAT environment allowed for public IP addresses or external remote access; and there were deficiencies in the telecom provider’s firewall policies, long-term log retention, firmware updates, and the company’s managed secondary firewall. The preliminary root cause is a combination of structural vulnerabilities: an outdated and poorly maintained communications security environment, reliance on a single perimeter defence, a lack of internal network segmentation, and insufficient centralized detection, logging, and recovery controls—rather than the type of communication line itself.