Key takeaways
Maritime cyber incidents
On the rise, with a 103% increase in 2025 compared to 2024.
Port cybersecurity
Can be compromised, including through cargo management systems and port infrastructure.
Port authority responsibility
Crucial to monitor cyber risk continuously and undertake regular risk assessments.
The global shipping industry handles approximately 80% of global trade. In recent years, there has been a marked increase in the digitalisation of ships and ports, which has improved efficiency, enhanced communication and allowed real-time ship and container tracking.
Digital systems are already crucial to navigation, cargo management and communication within the industry. However, technological developments have also opened up the maritime sector to new vulnerabilities in the form of cyber threats and cyberattacks.
Cyberattacks on ships and ports can compromise the integrity, confidentiality and availability of data and systems. This can result in serious consequences that range from operational disruption and financial losses to environmental damage and even threats to human life.
Maritime cybersecurity is closely connected to supply chain security. A cyberattack on a port or logistics provider can quickly spread through global trade networks and cause widespread disruptions.
Ports are at the centre of global trade, acting as physical gateways for vessels and cargoes, but also operating as part of a digital, interconnected network through which terminal operators, port authorities, shipping companies and logistics providers share computer-based systems and exchange real-time data.
As a result, a cyberattack on a port can have far-reaching consequences extending beyond port or even national boundaries.
According to a 2026 Cyber Threat White Paper from Korean cyber security company, CYTUR Inc, maritime cyber incidents in 2025 surged by 103% compared to 2024.
At the end of 2025, NATO data revealed that cyberattacks on European and Mediterranean ports had surged from 10 incidents in 2021 to over 60 incidents in 2025. Security experts traced vulnerabilities to aging operational systems and unsecured digital service providers.
According to a World Bank report dated May 2026, ‘Cybersecurity in Ports: Shifting from Risk to Resilience,’ which draws on a global survey by the International Association of Ports and Harbours (IAPH) of over 100 port stakeholders to identify key policy, operational and capacity gaps, 61% of port authorities consider there is a high risk of cyber incidents.
Recent port cybersecurity breaches
On 14 October 2026, it was reported that a cyber extortion group, n0n, was threatening to publish data it claimed it had stolen from 38 shipping, port and logistics companies unless it was paid a multi-million-dollar ransom by 19 October.
Those targeted included 12 port and container terminal operators, 10 shipping lines and ship operators, port IT providers, logistics companies, and other maritime businesses across 18 countries.
As at time of writing, that claim remains unverified and none of the listed companies had confirmed any data breach. However, it has also been reported that n0n published 85 sample files on the dark web and that initial assessments suggest all the allegedly stolen data originates from one source, said to be a company that provides software and IT services to maritime companies.
Recent confirmed port cyberattacks include the following:
In 2023, a cyber-attack on DP World in Australia in 2023 resulted in the suspension of operations at three major ports and had a major impact on Australia’s import and export supply chain.
In early 2024, Nagoya port, Japan’s busiest container port, experienced a ransomware attack that paralysed its container terminal management system for several days, preventing truck loading and unloading operations. The attack caused widespread logistical disruptions, misrouted cargo manifests, and heightened navigation risks.
In April 2024, a multi-port and vessel-targeted cyber incident struck major European hubs using ransomware and Automatic Identification System (AIS) data manipulation.
In August 2026, three North Carolina ports experienced a cyber-attack on IT operations that disrupted cargo distribution and product flow.
In September 2026, the Malaysian port of Tanjung Pelepas suffered a cyber incident that temporarily suspended container terminal operations.
There are a number of ways in which maritime cybersecurity can be compromised. Below we illustrate a few of these.
Cargo management systems
Cargo management systems are key to port operations and onboard logistics. Data breaches by hackers who access cargo manifests, schedules or personal crew information can result in exploitation of that data for theft or smuggling of goods.
System manipulation can also take place when unauthorised persons infiltrate cargo tracking systems in order to redirect specific containers.
Such unauthorised access can be achieved in a number of ways, including through exploiting vulnerabilities in integrated IT-OT networks and phishing emails that target employees who have access to cargo systems.
Where communication networks onboard ships and within ports are poorly secured, communications may be disrupted and this can also delay any emergency response to an attack.
Port infrastructure
A cyberattack on a port can result in operational shutdown with the resulting financial losses and reputational damage.
Ports are very reliant on OT systems for cargo handling, access control, and overall management. If these systems do not have robust cybersecurity protections, there is a higher risk that security measures will be breached.
There is also the threat of ransomware in port management systems, with the result that malware can lock down port operations entirely.
Liability
Port authorities can face liability for inadequate security that impacts port infrastructure and operations.
Where a cyber-attack compromises port systems and results in operational disruptions or safety incidents, a port authority may be liable because it failed to maintain adequate cybersecurity standards.
The port authority’s responsibility likely also extends to ensuring that third-party vendors and service providers maintain cyber security practices to prevent supply chain attacks.
Port action
According to the World Bank report, ports and port authorities should therefore, among other things:
have clear cybersecurity rules for critical ports, including defined responsibilities, minimum requirements, compliance mechanisms, and mandatory incident reporting.
manage cyber risk continuously and undertake regular risk assessments, vulnerability scans, tested incident response and business continuity plans.
invest in cyber-resilient supply chains.
secure supply chains and customs data.
International Maritime Organisation action
In March 2026, the IMO Facilitation Committee (FAL Committee) approved the IMO Strategy on Maritime Digitalization, which is aimed at enhancing interoperability, system standardisation, data-sharing, and effective data governance across maritime stakeholders.
Furthermore, the IMO Maritime Cyber Code is under development as a non-mandatory, flexible framework covering ships, ports and ship-shore interfaces. It is expected to come into force in 2028 and is intended to be adaptable to national and regional requirements.
In May 2026, the IMO adopted the first non-mandatory global code for autonomous ships, which took effect on 1 July. This Code establishes a framework for the safe operation of autonomous and remotely controlled cargo ships, covering areas including navigation, connectivity, remote operations, and cybersecurity.
On 28 May 2026, the IMO also issued revised guidelines on maritime cyber risk management, providing recommendations to safeguard shipping against current and emerging cyber threats and vulnerabilities.
Further developments
Whilst an International Conference on Port and Maritime Security (ICPMS) took place in Athens from 12 to 13 October 2026, Greece (in its current role as UN Council President) will convene a high-level briefing on 29 October 2026 to consider emerging technologies, with an emphasis on maritime security.
Comment
The International Ship and Port Facility Security (ISPS) Code has binding legal force by virtue of Chapter XI-2 of the International Convention for the Safety of Life at Sea (SOLAS).
The Code requires contracting states to implement prescribed security measures in their territories with regard to vessels engaged on international voyages and the port facilities serving them.
It has been suggested that the scope of the ISPS Code arguably already extends to cyber security as well as physical threats.
Even if that proves not to be the case, guidance on how to approach port cyber security can be gained from considering the key obligations under the Code, which are to:
(i) conduct a port facility security assessment;
(ii) develop and maintain a port facility security plan;
(iii) monitor and update security measures as threats develop; and
(iv) provide training, drills and exercises.
Find out more about our Shipping expertise or contact us today to discuss how we can support you.
