A Retrospective Analysis of Maritime Cyber Security Incidents

Abstract

The maritime industry is undergoing a rapid evolution through the introduction of new technology and the digitization of existing services. At the same time, the digital attack surface is increasing, and incidents can lead to severe consequences. This study analyses and gives an overview of 46 maritime cyber security incidents from the last decade (2010-2020). We have collected information from open publications and reports, as well as anonymized data from insurance claims. Each incident is linked to a taxonomy of attack points related to onboard or off-ship systems, and the characteristics have been used to create a Top-10 list of maritime cyber threats. The results show that the maritime sector typically has incidents with low frequency and high impact, which makes them hard to predict and prepare for. We also infer that different types of attackers use a variety of attack points and techniques, hence there is no single solution to this problem.

1. Introduction

The maritime sector is a complex ecosystem, bringing together stakeholders and organizations of different sizes, maturity, complexity, and operational scope. During the last decade, the maritime industry has undergone a rapid evolution through the introduction of new technology and the digitization of existing services. While aiming to increase profit, these changes can also introduce new risks. In particular, the increased connectivity and the converging of Information Technology (IT) and Operation Technology (OT) systems will expose the maritime operations to new threats that may have severe financial and reputation repercussions. Further, the threat environment against the maritime sector is steadily becoming more hostile; cyber attacks are becoming more frequent and organized criminal networks and hostile nations are now targeting all actors in the digital value chain, including shipping companies, vessels, and their shore-side facilities.

In this paper we present a retrospective analysis of cyber security incidents from the last decade (2010-2020). Our analysis includes 46 reported incidents that have affected the stakeholders in the maritime sector in significant ways. Our work provides an overview of attack points and shows a mapping between these and the incidents. We have also created a threat categorization based on the characteristics of the incidents. While the main driver of our analysis was to increase the awareness of cyber security threats towards Norwegian maritime interests, the maritime operations are international and malicious actors know no borders. Hence, the results should be equally relevant for the international maritime community.

The paper is organized as follows. In Section 2, we give an overview of relevant background work on threats and incidents in the maritime sector. Section 3 introduces the methodology that we have applied when gathering the data for this paper. Section 4 presents the target description, which includes an overview of the special characteristics of maritime systems and a generalized representation of the shipboard and off-ship systems with annotated attack points. Section 5 contains an overview of incidents, while Section 6 builds a categorization of threats based on the incidents. Section 7 discusses the trends related to incidents and threats, and what we can expect for the present and the road ahead. Finally, in Section 8 we conclude our work and point to future opportunities.

2. Background

Initial work on security threats to the maritime sector was mainly focused on terrorism. In 2011, ENISA released the report "Analysis of Cyber Security Aspects in the Maritime Sector", which recognized the maritime sector as a critical infrastructure. The report identified the very low awareness of cyber security in the sector as being a major challenge and suggested that the low number of publicly known cyber security incidents could be the reason. In 2015, a Norwegian report on digital vulnerabilities in the maritime sector was released. It identified the top 10 challenges in the sector and provided examples of both attacks and accidents that had been possible because of these. The same year, the EU project MUNIN performed a risk assessment of safety and cyber security threats, in which jamming, spoofing and hacking of AIS, GPS and ship communication equipment were considered as the highest risks. Threats specific to maritime digital communication were identified in the Norwegian research project CySiMS. Researchers from the University of Plymouth have over several years published papers related to vulnerabilities, threats and attacks to the maritime sector, and there are further examples of security research on autonomous shipping, ports and port systems, and IT/OT systems installed on vessels.

In 2017, the British Department of Transport published an overview of motivations for attacking ship systems, including potential threat actors. The following year, ENISA published their report on the cyber threat landscape, claiming that cyber criminals and state-sponsored actors were taking over the scene and that monetization was becoming one of the main drivers for cyber attacks. Their standpoint has recently been confirmed by the Norwegian Police Security Service, which identifies state-sponsored intelligence operations against the maritime industry as a significant risk to Norway. Further, the Norwegian National Security Authority (NSM) provides annual reports on the cyber threat picture against Norway, which includes ransomware, digital intelligence operations and disturbance of positioning services.

The above-mentioned sources provide a thorough analysis of cyber security vulnerabilities, threats and risks relevant for maritime operations, but most of them lack an anchoring in empirical evidence. Nevertheless, they have been a useful basis for analyzing, mapping and interpreting our results.

3. Methodology

To collect information about incidents, we screened scientific publications, public and commercial reports, newspapers and other forms of grey literature, using keywords such as "cyber attack", "cyber incident", "cyber risk", "cyber threat", "cyber security" and "maritime" in popular search engines and indexing databases (Google, Google Scholar, IEEE Xplore and SpringerLink). We also searched in the Lloyd's List database for cyber security events. Furthermore, we applied a snowballing technique, which means that we screened our sources' sources, to locate additional relevant literature that did not show up in our initial searches. We did, whenever possible, strive to use several independent sources to confirm the validity of each of the reported incidents, and we revised our original sources by reading reports that compiled several of the previously reported incidents.

Our final selection of incidents included in the analysis was based on the following criteria: the incidents must have occurred during the last decade (2010 to 2020); they must have been caused by "successful" attacks, excluding mere attack attempts or unsuccessful attacks; they must have been caused by a real attack, excluding any "white hat" experiments performed by students, security companies or researchers; they must have had a direct effect on any of the core systems in the maritime ecosystem, excluding incidents only vaguely related to shipping; and they must have had a significant impact on the maritime industry, excluding "minor" incidents. In addition to public literature, we collaborated with representatives from the Intelligence and Operations Centre at The Norwegian Shipowners' Mutual War Risk Insurance Association and the Norwegian Maritime Cyber Resilience Centre. They provided us with anonymized event data, which resulted in the identification of additional incidents, only a few of which have been mentioned in open reports.

Shipping is a very diverse sector, from small dry bulkers carrying sand and gravel along the coast to large container ships in intercontinental trade. It is highly unlikely that this study has captured all the different cyber incidents across the sector, as most of the quoted references tend to focus on larger ships and operations. The sources are also biased in that they are mostly from the western world, including a number of Norwegian reports. The reader should keep this bias in mind when reading this paper, but the authors still believe that this is a representative report on the general situation related to cyber incidents and threats in the maritime sector.

4. Target Description and Attack Points

To systematically analyze the incidents, there is a need to describe the scope and context of our study. Here we provide an overview of the special characteristics of the maritime industry and models of the onboard and off-ship systems. The maritime industry has some special characteristics which result in a threat profile that differs significantly from the more traditional land-based systems: it is a relatively small industry, with about 98,000 propelled seagoing merchant vessels of 100 gross tons and above operating internationally, which limits the industry's ability to do systematic analyses and to learn from others; ships are complex "sailing villages" with a wide range of information and communication technology (ICT) onboard, from office systems via life support systems and engine automation to navigation systems; ships normally have a lifetime of 25-35 years and software upgrades are done on individual equipment at different time intervals, meaning most ships carry a very mixed set of administrative, IT and OT equipment; it is a highly cost-sensitive market due to strong international competition, resulting in a large share of stakeholders not giving cybersecurity the required priority; and ships are under international regulation which has tended to focus on minimum technical requirements to ensure a level economic playing field. These issues result in complex but highly inhomogeneous and sometimes poorly maintained ICT systems. As digitalization in the maritime sector increases and more ships become connected to the Internet, a larger attack surface is exposed, making shipping a more tempting target for commercially motivated attackers, state terrorism and the more "adventurous" hackers.

Figure 1 in the original paper shows a generalized representation of onboard systems with attack points classified as S1 to S7: S1 represents attacks on operational technology, usually located in a controlled environment, including attacks via movable external memory systems (MEMS or "memory sticks") sometimes used for software or electronic chart updates; S2 represents attacks on administrative systems onboard; S3 and S4 are attacks on mobile/satellite communication or VHF radio digital communication respectively; S5 represents attacks on Global Maritime Distress and Safety Systems (GMDSS); S6 on Global Navigation Satellite Systems (GNSS); and S7 on peripheral devices to controlled systems, while S0 is used for other onboard attacks. Note that the topologies on different ships vary wildly, and particularly older ships may have much less system separation in place.

The other group of attack points covers ship-to-shore communication links and the corresponding shore systems, as illustrated in Figure 2 of the original paper. The first group belongs to public infrastructure. The most relevant here are the VHF voice and data transmission infrastructure, including automatic identification system (AIS) services (L1); the vessel traffic services, maritime rescue and GMDSS services (L2); various information services to ships, including meteorological data, recommended routes and notices to mariners (L3); and digitalized aids to navigation (L4), with other attack points in this group labelled L0. The next group covers authorities and class societies: M1 relates to ship and crew certificates, e.g. from the flag state; M2 to services and documents issued by class societies; and M3 to authority services related to arrival and departure clearance, e.g. maritime single windows (MSW), passenger clearance and phytosanitary services, with M0 for other attack points in this group. Port operations include services to ships such as tugs and linesmen (H1); H2 labels attacks on internal communication and data exchange inside ports and terminals; H3 labels attacks on port operations data systems such as harbour master systems; and H4 labels attacks on cargo data systems in the port, which can also include port community systems (PCS), with H0 for other port service attack points. Finally, private services are grouped into ship operators such as owners, managers and charterers (P1); P2 codes for technical services from yards and spare-part or consumable suppliers; and P3 for other services such as weather routing and route optimization, with P0 representing other services.

The taxonomy of identifiers should be seen as preliminary: not all of these attack points have been mapped to actual incidents. However, they are still relevant for potential threats and for future mapping of new incidents.

5. Known Incidents (A1–A46)

Below we describe the incidents we have identified based on the methodology and criteria from Section 3; each incident carries a unique identifier together with the relevant year(s) and the attack point from the previous section. In 2010, a drilling rig was infected by malware on its way from the construction site in South Korea to South America (A1, S1): critical control systems were infected, requiring 19 days of downtime, with such shutdowns estimated to cost 700,000 USD per day; and a Greek shipping company was hacked via its headquarters' WiFi network (A2, P1), with vessel and sailing-route information exfiltrated for two years and used by the attackers to plan physical pirate attacks in the Gulf of Aden. In 2011-2013, the cargo tracking system at the Port of Antwerp was infected (A3, H4) to enable smuggling of drugs and weapons ("concealed" as bananas from South America); the smuggling operation went on for two years before detection, and the same port suffered the same attack again in 2018; and a threat actor dubbed "Icefog" conducted targeted cyber espionage attacks against sensitive organizations in South Korea and Japan, including maritime and shipbuilding groups (A4, P2), relying on spear-phishing and exploitation of known vulnerabilities. In 2011, a cyber attack against the Iranian shipping company IRISL damaged all data related to rates, loading, cargo numbers, dates and places (A5, P1) and crippled the company's internal communication network, causing severe financial losses and loss of cargo; and in 2012 Iranian officials reported a cyber attack on communication networks of an offshore platform in the Persian Gulf (A6, S3). In 2012, the cargo handling system used by the Australian Customs and Border Protection Service was infected (A7, H4), enabling the attackers to see whether their shipments were flagged as suspicious, in which case the smuggled goods were never picked up; and Chinese hackers were accused of a targeted attack against the Danish Maritime Authority (A8, M1), in which documents and network-topology information were stolen via a virus-infected PDF attachment sent by email.

In 2013, crew onboard a drilling rig in the Gulf of Mexico accidentally connected virus-infected PCs and USB devices to the rig's local network (A9, S1), disturbing communication between the dynamic positioning system and the thrusters so that drilling operations halted; and in 2014 hackers intercepted and altered emails with account numbers for money transfers (A10, P1), targeting transactions between shipping lines and bunker suppliers and between shipping lines and shipyards and causing severe financial losses. A report from Windward shows that between 2012 and 2014, 1% of all ships provided fake identification information (IMO numbers) in their AIS transmissions (A11, S4), and more than 25% of vessels disabled their AIS ("going dark") at least 10% of the time — techniques often used in connection with smuggling, terrorism, human trafficking, illegal fishing or military conflicts. In 2016 in South Korea, 280 ships had to return to port after experiencing navigation-system problems (A12, S6); North Korea was blamed but evidence is lacking; and an analysis by the Norwegian Coastal Administration of historical AIS data from 2014-2017 shows that civilian Russian vessels perform regular stops along the Norwegian coast that are unnatural for their primary objectives (A13, S4), tending to coincide in time and space with NATO operations, training or drills, giving reason to suspect electronic espionage, with similar activity observed in the South China Sea and the Black Sea. In 2017, British ship broker Clarksons was hacked (A14, P3) and the attackers demanded a ransom for stolen data, with sensitive information stolen and the stock value dropping by about 5% immediately after the incident; and shipping giant Maersk's operations were severely crippled by the NotPetya ransomware (A15, P1), spread via an update patch for the MeDoc tax accounting software and exploiting Microsoft Windows vulnerabilities based on EternalBlue — seen as the most devastating cyber attack in history, affecting almost one fifth of global shipping operations including 76 ports, with Maersk estimating economic losses near 300 million USD and more than 4,000 servers, 45,000 PCs and 2,500 applications requiring reinstallation. In 2017, at least 20 ships in the Black Sea near Novorossiysk reported navigation systems showing a position 32 km away from their actual positions (A16, S6), likely caused by GNSS spoofing.

In 2018, a ship was exposed to GPS spoofing in the Black Sea (A17, S6): at sea, yet the onboard geolocation system claimed the ship was on land — four times over three days for up to 30 minutes; and Chinese hackers were accused of stealing information from subcontractors of the US Navy (A18, P3), with 27 American universities presumed attacked in an attempt to steal maritime-technology research data. The Port of Barcelona reported a cyber attack (A19, H4) that turned out to be a Ryuk ransomware infection affecting only internal IT systems, not ship traffic; and only five days later the Port of San Diego reported severe IT disruptions (A20, H4) — another Ryuk infection limited to local port functions, though whether the events were related is unclear. Iranian hackers were blamed for stealing ship designs and personnel information from the Australian shipbuilder Austal (A21, P2), which delivers naval vessels to Australia and the US; the stolen information was later offered for sale on the dark web and the hackers also attempted to extort money from Austal; and a Nigerian hacker group nicknamed "Gold Galleon" allegedly stole hundreds of thousands of USD by compromising and spoofing business emails of maritime shipping businesses (A22, P1), mainly targeting Japanese and South Korean companies. COSCO Shipping Lines were hit by a cyber attack (A23, P1) severely disrupting their US office networks, with email and network telephone communication unavailable for five days in what internal emails described as a ransomware infection; and Italian oilfield services company Saipem detected a cyber attack against its Middle East servers (A24, P3), with about 400 servers hit — especially in Saudi Arabia and the UAE — though backups avoided permanent data loss and no data was believed stolen. In 2019, a large ship on its way to New York had its onboard control system network infected with malware (A25, S1), resulting in limited functionality; and GPS jamming was observed on multiple occasions through 2018-2019 in northern Norway (A26, S6), affecting marine traffic to some extent though severe consequences were fortunately avoided.

In 2019, an undisclosed American port was infected by the Ryuk ransomware (A27, H3) via a phishing email attachment, leaving CCTV cameras, access control systems and critical process monitoring unavailable; and British marine services provider James Fisher and Sons was infected by ransomware (A28, P3) and forced to shut down its digital systems, with the share value dropping 7% after the incident. A natural gas compression facility at an undisclosed US pipeline operator was infected with ransomware, presumably Ryuk (A29, S1), and had to shut down for two days after a phishing-email attack impacting both IT and OT systems; and a tanker near the port of Naantali in Finland had its administration server infected by ransomware (A30, S2) with the backup disk wiped as well — Remote Desktop Protocol (RDP), a USB device or an email attachment identified as probable vectors — with the same vessel infected again four months later near the same port. Two ships with the same owner were infected by the Hermes 2.1 ransomware (A31, S2) arriving as a macro-enabled Word document attached to an email, affecting multiple workstations on the administrative networks; and a vessel anchored near Tynemouth, UK, had its ship server and multiple PC clients infected with the Ryuk ransomware (A32, S2), with all data encrypted and lost so that a full reinstall was necessary. Three ships sailing under the American flag had their administrative systems infected by the Sodinokibi ransomware (A33, S2), which also threatened to leak information ("ransomtheft") in addition to encrypting data. The shipping company MSC fell victim to a ransomware virus (A34, P1) and its Geneva headquarters were shut down for five days; and Israel was blamed for hacking the Iranian port of Shahid Rajaee (A35, H3), halting all transportation and goods flows for a long time in what was claimed as retaliation after an attack on an Israeli water distribution system. Norwegian shipbuilder Vard was hit by a ransomware attack (A36, P2) causing severe operational disruption, with many employees informed that the disruptions could lead to temporary job losses because of halted shipbuilding.

In 2019-2020, cruise operator Carnival Corporation & plc was hit by a ransomware virus twice in two years (A37, P1), with personal information and credit card details of customers and employees likely stolen; Transport Malta suffered a cyber attack (A38, M1) shutting down its online systems for five days; Greek shipping company Diana Shipping fell victim to the Egregor ransomware (A39, P1) with little information known; and French container carrier CMA CGM was hit by the Ragnar Locker ransomware (A40, P1), affecting several of its Chinese offices and forcing online services including online booking to shut down. The UN shipping agency IMO had its website and intranet disabled by a cyber attack (A41, M1) described as "sophisticated", with several other key systems shut down to prevent further damage; British ferry firm Red Funnel was hit by a cyber attack (A42, P1) severely disrupting its IT systems, with booking systems unavailable for several days and customers forced to arrive well in advance to buy tickets on-site; US transportation and shipping company Matson reported a system outage due to a cyber attack (A43, P1) that did not stop cargo operations though some transactions were delayed and replaced by manual processes. The Port of Kennewick had its IT systems crippled by ransomware (A44, H4); the hackers demanded 200,000 USD which was not paid, and systems were unavailable for several days while re-established from offline backups; Norwegian cruise operator Hurtigruten suffered a severe ransomware attack (A45, P1) heavily impacting its IT infrastructure for several days, with passenger data such as passport information exposed and possibly stolen; and German cruise operator AIDA had its Rostock headquarters hit by DoppelPaymer ransomware (A46, P1), causing severe IT issues and forcing the cancellation of several cruises.

Our look into the rear-view mirror tells us that the maritime industry has not had an overwhelming number of incidents — at least not ones significant enough to be publicly reported or to make the news headlines. To put our number of 46 incidents in perspective, there were 41,158 cyber incident claims in the "service industries" between 2010 and 2020 according to a dataset received from the insurance data provider Advisen, a Zywave company (dated 25 February 2021), and 4,088 cyber incident claims within "transportation, communications and utilities" during the same period — yet some of the most severe consequences in any sector can be tied to maritime. This shows that these low-frequency, very-high-impact incidents indicate challenging cyber risks: difficult to predict and prepare for based on history, and in hindsight often considered black swans. Considering incidents per year (Figure 3 in the original paper), the number multiplied by seven from 2010 to 2020. This growth was not linear: there was a noticeable dip during 2013-2016, a slumber period that may have given a false sense of security, as some of the 2017 incidents (especially A14 and A15) seemed to take the affected organizations by surprise and resulted in quite severe consequences. Looking at which attack points were used over the years (Figure 4), they are fairly distributed over time and attack points, with one obvious peak for P1 in 2020 caused by many exploited IT systems for private onshore operations. With a growing number of incidents, exploitation of the attack surface widens too — meaning there is probably no single cause to eliminate, and a variety of risk modifiers must be implemented.

6. Cyber Threat Categorization: Top-10 List

A threat is the potential cause of an unwanted incident, which can result in harm. Based on the known incidents and related work, we have established a Top-10 list of maritime cyber threats. The categories are defined by similar characteristics among the incidents and are ranked based on frequency and severity. For each category we describe typical attack vectors and targets. Some incidents have been associated with more than one category, which is natural for attacks consisting of several stages that can affect more than one target. Hence, the categories are not mutually exclusive and can overlap for a single incident.

6.1 Exposed shipping company/carrier IT systems — these have had a burst of associated cyber incidents in the last year and can be linked to 25% of the total incidents of the last decade; the most common attack vector is ransomware, usually via email attachments or links, with an increasing trend of ransomtheft viruses combining outages and information theft, plus many examples of economic fraud from social engineering attacks (Incidents: A2, A5, A10, A15, A22, A23, A34, A37, A39, A40, A42, A43, A45, A46). 6.2 Exposed IT systems of sub-contractors, shipyards, onshore installations, service providers, regulators and research facilities — a similar threat picture to shipping companies, typically involving theft of business-critical information as well as more random extortion cases, with social manipulation, hacking and ransomware as commonly used vectors (Incidents: A8, A14, A18, A21, A24, A28, A29, A36, A38, A41). 6.3 Exposed port IT systems — ports have been popular targets with a reputation of being poorly protected; outages are expensive, making them attractive for extortionists, while information theft and manipulation have been used for smuggling operations; some incidents only report that the port was "hacked", and in conflict areas state-sponsored actors/cyber warriors can be suspected (Incidents: A3, A7, A15, A19, A20, A27, A35, A44).

6.4 Espionage on maritime operations — extensive, targeted attacks related to espionage, tapping and surveillance of maritime operations, with spear-phishing, general hacking and communication tapping as mentioned vectors (Incidents: A4, A7, A8, A13, A18, A21). 6.5 Exposed IT systems onboard ships/offshore installations — several ransomware incidents onboard that appear more coincidental than targeted, typically via email attachments and links rendering ship servers and clients useless, with limited forensic evidence since data are usually wiped clean (Incidents: A30, A31, A32, A33). 6.6 Manipulation of GNSS signals used by ships — mainly jamming or spoofing of GPS/GNSS signals for navigational purposes; state-sponsored actors tend to be suspected, consequences have been more disturbing than critical, and this threat typically manifests in geopolitical conflict areas such as the Black Sea (Incidents: A12, A16, A17, A26). 6.7 Exposed OT systems onboard ships/offshore installations — usually separated from other systems and therefore less exposed, yet examples exist with critical consequences; attacks typically entered via infected USB units or computers unintentionally connected to the wrong network, e.g. ECDIS during map updates and propulsion control systems (Incidents: A1, A9, A25, A29).

6.8 Exposed communication systems — a few examples of attacks against communications systems for land-based operations and offshore installations; ship communications have not been much affected, but with many different necessary communication systems onboard they remain potential victims, with consequences tending towards loss of availability from generic hacking or ransomware (Incidents: A5, A6, A13, A23). 6.9 Economic fraud — targeted, specialized attacks where counterfeit emails or hacked user accounts initiate or manipulate economic transactions, e.g. altered account information or fake invoices (Incidents: A10, A22). 6.10 Misuse of AIS and positioning data — known events where onboard AIS systems were unlawfully manipulated or deactivated, usually related to smuggling, trafficking, illegal fishing or military conflicts; potential consequences could at worst be collisions, but more likely other ships being forced to alter course unnecessarily (Incidents: A11, several). Figure 5 in the original paper shows how the incidents sort under the Top-10 threats: the three largest slices all relate to exposed land-based IT infrastructures that the maritime industry depends on — unsurprising given their high network connectivity and myriad "ordinary" vulnerabilities shared across all sectors depending on digital COTS technology — while ENISA has described ports-specific cyber security challenges such as lack of digital culture, awareness, training, budget and qualified people, amplified for the maritime sector.

7. Discussion

In addition to the limitations in Section 3.1, we acknowledge several weaknesses in our incident data. First, there is a reporting bias by the industry itself, as there have been few incentives to disclose incidents publicly; still, we believe many of the incidents we have seen were too big to hide and that there are not many others of the same magnitude unreported. Second, there is now more attention towards cyber incidents than in the past, increasing the chance that an incident gets news coverage — which might inflate the number of reported incidents in the last years of the study period. Third, the incident counts by year and attack point lack the statistical significance to reveal clear trends, so we must give a qualitative interpretation and real extrapolation from this data material is not possible. Fourth, some incidents spanned multiple years and in some cases a single report represented a collection of smaller incidents, so the distribution over time is somewhat skewed.

Figure 5 shows how the incidents sort under the Top-10 threats. The three largest slices all relate to exposed land-based IT infrastructures that the maritime industry depends on — unsurprising given their high network connectivity and the myriad "ordinary" vulnerabilities shared between all sectors depending on digital COTS technology. Malware insertion, particularly ransomware and ransomtheft, has been the prevalent attack method, just as in every other sector and among ordinary citizens. There are also many examples of fraud using social engineering techniques, fake invoices and theft of user accounts. These attacks stem from cybercrime actors with "pure" economic motives. Taking down the value chain behind these attacks might be more effective than trying to protect every attack point at all times. This requires international collaboration between law enforcement agencies, CERT/threat intelligence organizations and the industry. Threats related to espionage on maritime operations, attacks on sub-contractors, shipyards and research facilities, as well as attacks on GNSS systems, may be linked to another breed of actors — particularly state-sponsored actors or cyber warriors. These are well-funded, motivated by political factors or acquiring foreign technology, and can be extremely difficult to defend against. Active involvement of national security authorities and intelligence offices is necessary to support the maritime industry facing these threats.

Looking backwards does not provide an accurate idea of present and future threats. Just as most other sectors, the maritime industry is undergoing rapid digitalization and technology development, which increases the digital attack surface. At the same time, digital value chains and dependencies can cause one industry to suffer when another is hit hard. The ongoing COVID-19 pandemic has, for instance, shown that events not directly tied to cyber or maritime interests can cause a wave of consequences throughout society. Both ENISA and INTERPOL point to pandemic-driven changes in the threat landscape, in particular vulnerabilities due to work-from-home offices. According to McAfee, there was a 605% increase in COVID-19 themed threats in Q2 2020. Naval Dome and WorkBoat have also shown a severe increase in such attacks specifically targeting maritime interests. Examples are malicious emails with subject fields such as "Maersk New Shipping schedule details due to COVID-19-Shipment notification" and "COVID-19 SUSPECTED CREW/VESSEL". The attackers take advantage of the fact that people under a lot of strain tend to forget their regular cyber hygiene. It has also become more difficult for maintenance and inspection crews to visit ships in ports around the world, and a quick fix has been to enable remote access methods — which can easily backfire and create attack openings in traditionally closed systems. It has been outside the scope of this study to create future threat estimations, but to quote Hoo: "despite the fact that the road ahead may bend with human whim and technological advance, ...it does not appear to bend too sharply too often". We are not likely to get rid of the many threats seen in the last decade, and we should build our systems to tackle unforeseen ones as well. This accords with Ben Densham of Nettitude's statement that ship systems "need constant attention in operation to guard against the speed and agility of threats and attacks in the cyber arena".

8. Conclusion and Further Work

Our retrospective analysis of maritime cyber security incidents shows that even though this sector has not had the most incidents, it has had some of the most severe consequences from cyber attacks. A wide variety of attack points against complex systems onboard and off-ship have been used. Most of them have attack vectors typical for any land-based IT infrastructure and tend to be economically motivated, aiming to hit as many targets as possible. At the same time, we find more sophisticated, targeted attacks whose goals seem to be disruption or espionage. We therefore face high complexity in both the systems themselves and the threat environment. These factors make cyber risk management very difficult and potentially costly for individual maritime organizations to handle alone.

Furthermore, current knowledge about incidents and emerging threats is fragmented and somewhat unavailable. We encourage further work and international collaboration on threat intelligence sharing, so that updated information about attack attempts, incidents, techniques and the people behind them can support cyber security decision making, technology development and operations.

Acknowledgments

This work has been supported by the Research Council of Norway through the projects "Cyber Security in Merchant Shipping - Service Evolution" with contract number 295969 and "Digital Ecosystems for Smart and Autonomous Ships" with contract number 309255. We thank the anonymous reviewers for critically reading the manuscript and suggesting improvements.

References

Full reference list (83 sources) available in the original paper (PDF): ENISA, DNV-GL, MUNIN and CySiMS reports; Lloyd's List, Safety4Sea, Maritime Executive and BleepingComputer coverage; IMO, UNCTAD and ISO/IEC 27000 documents; literature such as Jones & Tam, Caprolu, Aven and Taleb on black swans; plus insurance-claims data from Advisen and anonymized event data from the Norwegian Shipowners' Mutual War Risk Insurance Association (DNK) and the Norwegian Maritime Cyber Resilience Centre.