Cybersecurity at Sea: A Literature Review of Cyber-Attack Impacts and Defenses in Maritime Supply Chains

Abstract

The maritime industry is constantly evolving, and growing digitalization has raised concerns about cyber-attacks on maritime supply chain agents. Although scholars have proposed methods and classification models to counter these threats, a comprehensive cyber-attack taxonomy for maritime supply chain actors based on a systematic literature review is still lacking. This review provides a clear picture of common cyber-attacks and develops a taxonomy for their categorization, alongside best practices derived from academic research using PRISMA principles, which identified 110 relevant journal papers. The study highlights that distributed denial of service (DDoS) attacks and malware are top concerns for all maritime supply chain stakeholders, while shipping companies are urged to prioritize defenses against hijacking, spoofing, and jamming. It identifies 18 practices grouped into information security management solutions, information security policies, and cybersecurity awareness and training. Finally, it explores how emerging technologies — with Industry 4.0 as part of a larger landscape of technological innovation — can prevent and mitigate cyber-attacks in the maritime supply chain network (MSCN).

1. Introduction

Maritime transportation carries roughly 80–90% of global trade in commodities and raw resources, and a maritime supply chain network (MSCN) links freight forwarders, shipping lines, and port terminal operators. As globalization and competition intensify, these stakeholders have adopted Industry 4.0 technologies to cut waiting times and raise efficiency in complex operations such as navigation and cargo handling. Yet this digital transformation introduces new cyber-attack risks that have become a major concern for MSCN agents: Lloyd's Register documented an annual increase of 27%, with 86% of organizations reporting attacks in 2017, a situation worsened by a four-fold global rise during the COVID-19 pandemic.

Cybersecurity is therefore critical for the industry: in 2021 the International Maritime Organization (IMO) mandated cyber risk management strategies for shipowners, and classification societies such as the American Bureau of Shipping (ABS) and Det Norske Veritas (DNV) promote effective cyber risk management systems. The MSCN operates in a highly interconnected environment where a vulnerability can propagate rapidly across shipping companies, port authorities, and logistics providers, so a single incident can cascade into systemic failure with severe safety, financial, and operational consequences.

Earlier academic work classified attacks on on-board versus off-board systems, or studied specific technologies such as AIS, IoT, cloud, blockchains, and AI, but these efforts lack a holistic, supply-chain-wide framework with practical mitigation guidance. To fill this gap, this study conducts a systematic literature review (SLR) guided by three research questions — which cyber-attacks are reported in the MSCN literature (RQ1), which preventive and mitigating practices are reported (RQ2), and which emerging technologies address them (RQ3) — and contributes a historical evidence analysis, a multi-dimensional attack taxonomy, actionable recommendations, and a review of emerging defenses. The remainder of the paper covers maritime cybersecurity background, the SLR methodology, descriptive statistics, results per research question, and conclusions with future directions.

2. Methodology: A PRISMA-Based Systematic Review

This study follows the PRISMA framework for systematic literature reviews, a structured three-stage process of identification, screening, and inclusion. In the identification stage the authors searched Elsevier's Scopus and Web of Science — the two most comprehensive scientific databases — with a Boolean query combining cyber keywords (cyber risk, cyber-attack, cybersecurity) and maritime keywords (maritime supply chain, shipping, ports), without time restrictions; the June 2024 searches retrieved 1,443 papers (62% from Scopus, 38% from Web of Science).

In the screening stage, automatic filtering kept only English-language peer-reviewed journal papers and excluded gray literature such as blogs, government papers, and conference proceedings, removing over 70% of records per database plus 114 duplicates. The authors then examined titles, abstracts, and conclusions against the study objectives, yielding 116 papers explicitly focused on cyber-attacks in the MSCN; special attention was paid to inconsistent incident-reporting standards and the potential influence of funding sources as sources of bias.

In the inclusion stage, four reviewers independently screened each record, keeping only documents that adequately addressed at least one research question; six publications were excluded, leaving 110 papers for analysis, with publication year, journal, author country, keywords, and MSCN actor recorded for each. Descriptive statistics show 60% of studies focus on shipping lines, 24% on port operators, and 16% on freight forwarders — indicating shipping lines face the highest reported risk — while prevention practices receive the most attention around ports, and emerging technologies target the security of shipping lines and ports.

3. Cyber-Attacks and the Proposed Taxonomy (RQ1)

The review identifies eight primary attack categories: denial of service (DoS/DDoS), which floods systems with excessive traffic and threatens underwater sensor networks, IoT devices, port operations, and vessel networks including AIS; malware, ransomware, and Trojans, which endanger port infrastructure and on-board systems such as SCADA and vessel management systems; and human-targeted vectors — social engineering, tampering, phishing, and spear phishing — which exploit crew and staff vulnerabilities through deceptive messages, as in the 2011–2013 Port of Antwerp intrusion. Less frequent but serious vectors include brute force (as in the 2018 probing of 225,000 accounts at the Port of Vancouver), identity fraud, watering-hole attacks, and port scanning.

Navigation-system attacks — hijacking, jamming, and spoofing — primarily threaten shipping companies by compromising GPS, AIS, and integrated bridge systems with deceptive signals, as in the 2017 Novorossiysk GPS spoofing incident; reported in 12 of the 15 years analyzed, they are the most common historical category alongside malware and ransomware. Compiling 68 documented incidents, the historical record shows hijacking/jamming/spoofing first and malware second, with a sharp rise in denial-of-service attacks since 2023 and growing social-engineering attacks; the United States reported the most incidents, followed by the United Kingdom and Iran, although the true count is likely higher because firms underreport to protect their interests.

From the 110 papers the authors build a seven-dimension taxonomy classifying each attack by (1) hacker group (criminals, terrorists, hacktivists, competitors, state actors), (2) attack type (untargeted versus targeted), (3) compromised AIC-triad element (availability, integrity, confidentiality), (4) affected MSCN agent, (5) affected systems and technologies, (6) geopolitical impact (local, national, or international), and (7) potential consequences (ecological, financial, or human). Unlike MITRE ATT&CK, which details tactics and techniques, or incident-based taxonomies limited to affected systems, this taxonomy captures maritime-specific dimensions such as geopolitics and attacker motivation, and maps directly onto the NIST functions (identify, protect, detect, respond, recover) and IMO Resolution MSC.428(98) for cyber risk management.

4. Prevention and Mitigation Practices (RQ2)

The review distills 18 practices in three groups. Information security management (nine practices) includes risk-management tools such as the MITIGATE methodology and FMECA/MITRE ATT&CK adaptations for marine systems; security-by-design IoT programming and physically unclonable functions for authentication; detection-blocking techniques such as propulsion-system encryption, NMEA anomaly detection, Auth-AIS, and blockchain-based port frameworks; multi-factor authentication, strong passwords, and antivirus; physical barriers and intelligent sensors at port interfaces; RFID management; and VPNs, disk encryption, and intrusion detection adapted to limited maritime bandwidth.

Information security policy practices emphasize collaboration among MSCN agents and international stakeholders through shared platforms and workshops; standardization around ISO/IEC 27001 and NIST guidance; and a proposed certification authority for Maritime Mobile Service Identity (MMSI) pseudonyms to protect vessel identity. Awareness and training practices — the study's most stressed recommendation given the human factor — call for specialized training courses and platforms, a shared risk-assessment library, a common maritime cyber glossary, a dedicated port cyber resilience officer role, and regular cyber hygiene (robust passwords, updates, backups, satellite-link protection).

5. Emerging Technologies and Conclusions (RQ3)

For RQ3, the review first surveys Industry 4.0 technologies already in MSCN use: cloud computing for e-navigation and smart-port logistics; IoT with secure-by-design transmission protocols; big data analytics for accident-risk estimation, voyage planning, emissions reduction, and large-scale NMEA analysis; and AI plus virtual reality for vulnerability detection, pattern recognition, and crew training simulations. These principles — interconnectivity, automation, real-time data, and systems integration — enable adaptive, predictive defenses suited to complex maritime logistics.

Looking ahead, generative AI and large language models (LLMs) emerge as transformative defenses: adaptive systems that learn to detect anomalous traffic and mitigate denial-of-service attacks in real time; model-based detection of malware and ransomware enabling early intervention aboard vessels and in ports; generative adversarial imitation learning (GAIL) for secure autonomous-vessel navigation against spoofing, jamming, and hijacking; security-by-design integration in ship design; and natural language processing models that analyze communication patterns to flag phishing and identity fraud — even as the same generative tools make offensive phishing more convincing.

The study concludes that MSCN agents should prioritize countering denial of service and malware, with shipping lines additionally hardening against hijacking, spoofing, and jamming, and that shared knowledge, joint protocols, and personnel training are the pivotal strategies for reducing attack frequency and impact. Limitations include reliance on journal-reported incidents — many attacks go unregistered — and the publication time lag in a fast-moving threat landscape, so the authors urge future work with real-time data, industry reports, and direct stakeholder surveys. Full details, figures, and the complete reference list are available in the original PDF.