A cyberattack on an oil tanker disrupted onboard communications and vessel management systems, highlighting the operational risks associated with inadequate network protection.
According to the International Marine Contractors Association (IMCA), the incident involved the deletion of operating systems and stored data from several computers connected to the vessel’s onboard server. Although inspections found no abnormalities in operational technology (OT) systems, the attack demonstrated how weaknesses in business IT infrastructure can disrupt vessel operations and potentially create wider safety risks.
What happened
The incident occurred while an oil tanker was sailing from Egypt to Galveston, Texas. During the voyage, a cyberattack affected multiple workstations connected to the vessel’s onboard server, deleting operating systems and stored information.
The attack also disrupted external email communications and vessel management programs, affecting the ship’s ability to carry out routine administrative and operational activities.
Following the incident, the attacker sent emails containing political and ideological statements, mocking the affected parties and claiming to have taken control of the vessel. The vessel was subsequently boarded by the US Coast Guard and the Federal Bureau of Investigation (FBI), resulting in additional delays and negative publicity.
In response, the vessel and company’s emergency response teams activated their procedures and isolated computers and servers suspected of being compromised.
They also changed the public IP address and the business network’s IP range. Recovery measures included restoring the server’s operating system and data, recovering a backup, reinstating email services and reinstalling the affected computers.
Inspections of key operational technology systems identified no abnormalities. Consequently, the confirmed damage was assessed as being limited to the vessel’s business IT network.
What went wrong
According to IMCA, the damage was consistent with a wiper-type cyberattack, in which malicious software is used to destroy data and disable systems rather than demand a ransom.
Although the initial point of entry has not been confirmed, the preliminary investigation identified several weaknesses in the vessel’s communications and cybersecurity arrangements.
The vessel relied heavily on its telecommunications provider’s firewall, without additional security devices directly managed by the company. Long-term security log retention was also limited, while the existing licensing arrangements made it difficult to update firewall firmware.
Further vulnerabilities included:
Outdated security infrastructure: The vessel’s communications and security environment had not been sufficiently updated or maintained.
Insufficient network segmentation: Inadequate separation between interconnected business systems may have allowed the attack to spread across multiple computers.
Weak access controls: Restrictions on user privileges and access to critical systems may not have been sufficient to contain the compromise.
Limited monitoring capabilities: Inadequate logging and centralized detection reduced the ability to identify suspicious activity and reconstruct how the attack occurred.
Dependence on a single security barrier: The absence of additional company-controlled protection increased reliance on the telecommunications provider’s firewall.
The existing VSAT communications environment also allowed public IP addresses or external remote access, while deficiencies were identified in firewall policies and security maintenance.
IMCA concluded that the preliminary root cause involved a combination of structural vulnerabilities rather than the type of satellite communication service used.
The big picture: IT security is part of vessel safety
This incident demonstrates that a cyberattack does not need to compromise navigation, propulsion or other operational technology systems to create significant disruption onboard.
Modern vessels depend on interconnected digital infrastructure for communications, administration, maintenance management and other essential activities. When these systems become unavailable, crews may face difficulties accessing information, coordinating with shore personnel and maintaining normal operational workflows.
The incident also illustrates the risks associated with treating a telecommunications provider’s firewall as the principal line of defense.
A firewall can provide an important security barrier, but it cannot independently prevent every threat, particularly when attackers gain access to interconnected systems or privileged user accounts.
Once an attacker compromises a central server or account, insufficient internal protections may allow malicious activity to spread across the network.
Another important consideration is the distinction between containment and recovery. Disconnecting affected systems can help prevent further damage, but responding without preserving forensic evidence may make it more difficult to determine how the attacker gained access.
The wider lesson is that cybersecurity must be integrated into vessel risk management, supported by effective network architecture, continuous monitoring and tested recovery procedures.
What could have reduced the risk?
IMCA emphasized that preventing similar incidents requires several complementary security measures rather than reliance on a single protective system.
The incident highlights the following practical considerations for shipowners, operators and vessel crews:
Strengthen network segmentation: Separate central servers, business workstations and operational technology networks to restrict the spread of malicious activity.
Establish independent security controls: Supplement telecommunications provider firewalls with company-managed protection, monitoring and assurance.
Maintain updated security systems: Ensure firewall firmware, operating systems and other security components are regularly maintained and updated.
Restrict access privileges: Limit administrative permissions and remote access to authorized personnel and services.
Improve threat detection and logging: Maintain sufficient firewall, server, endpoint and remote-access records to support early detection and forensic investigations.
Protect and test backups: Maintain resilient backups and regularly verify that essential systems and data can be restored following a destructive cyberattack.
Coordinate incident response: Isolate compromised systems promptly while preserving evidence needed to investigate the intrusion.
Verify corrective actions: Follow temporary containment measures with vulnerability remediation, forensic verification and testing of the effectiveness of security improvements.
Importantly, IMCA stressed that the choice between VSAT, Starlink or other satellite communications services does not determine a vessel’s cybersecurity resilience. Each service requires an appropriate company-controlled security architecture.
Changing IP addresses or blocking suspicious email domains may provide temporary protection, but these measures do not necessarily eliminate the underlying vulnerabilities that enabled an attack.
Ask your team
Are our vessel networks adequately segmented to prevent an attack on business IT systems from spreading to other equipment?
Do we rely primarily on our telecommunications provider’s firewall, or do we have additional company-controlled security measures?
Can our crews quickly identify and isolate compromised systems while preserving evidence for investigation?
Are our backups regularly tested to confirm that essential vessel systems and data can be restored?
How do we verify that vulnerabilities identified after a cyber incident have been effectively addressed?
Key takeaways
A cyberattack targeting business IT systems can cause serious operational disruption even when critical OT systems remain unaffected.
Reliance on a single firewall leaves vessels exposed to threats that may spread through interconnected networks.
Network segmentation, restricted access privileges and effective monitoring are essential for limiting cyberattack impacts.
Rapid isolation must be combined with forensic evidence preservation and reliable recovery procedures.
Temporary containment actions cannot replace the identification and correction of underlying security vulnerabilities.
Cybersecurity resilience depends on the effectiveness of the overall security architecture rather than the type of satellite communications service used.
——————————————————-
Click Here For The Original Source.
