HMM
Company Details
Linkedin ID:
hmmofficial
Website:
Employees number:
3,275
Number of followers:
128,167
NAICS:
483
Industry Type:
Homepage:
http://www.hmm21.com
IP Addresses:
0
Company ID:
HMM_3322229
Scan Status:
In-progress
HMM Company CyberSecurity Posture
http://www.hmm21.com
We are the global integrated logistics company that provides the utmost services through over a hundred vessels, the networks connecting the world, and our professional experts. As your friendly partner, we constantly strive to grow as a global shipping leader.
HMM A.I CyberSecurity Scoring
HMM Risk Score (AI oriented)Between 750 and 799
HMM
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
HMM Global Score (TPRM)XXXX
HMM
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
HMM Company CyberSecurity News & History
Past Incidents
2
Attack Types
1
Hyundai Merchant Marine (HMM)
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: In June 2021, **Hyundai Merchant Marine (HMM)**, a South Korea-based global shipping and logistics company, fell victim to a **phishing attack** that introduced a virus into its email systems. The breach disrupted email services across most regions, excluding America and Europe, rendering the systems unusable. The incident stemmed from unauthorized access, likely due to an employee falling prey to a deceptive email, allowing the virus to infiltrate critical infrastructure.The attack did not explicitly mention data theft, financial fraud, or ransom demands, but the **operational outage** of email servers—vital for business communications—posed significant internal disruptions. HMM, a key player in maritime logistics, relies heavily on seamless communication for cargo operations, customer coordination, and supply chain management. The inability to use email systems could have cascading effects, including delayed shipments, miscommunication with partners, and potential reputational damage. While no direct financial losses or data leaks were reported, the **disruption of core business functions** highlights the severity of the breach in a sector where timing and coordination are critical.The attack underscores the vulnerability of large enterprises to **social engineering tactics**, particularly in industries where cybersecurity awareness may lag behind technological adoption. HMM’s response likely involved isolating affected systems, restoring services, and reinforcing employee training to mitigate future risks.
Hyundai Merchant Marine (HMM)
Cyber Attack
Rankiteo Explanation
Attack threatening the economy of geographical region
Description: Hyundai Merchant Marine (HMM) was targeted in a prolonged cyber-espionage campaign from **April 2010 to 2013** by North Korean attackers using the **Icefog (Fucobha) backdoor**. The attack, part of the **Kimsuky APT group**, relied on **spear-phishing and exploits of known vulnerabilities** to infiltrate the company’s systems. The attackers maintained persistent access for **months to years**, continuously exfiltrating sensitive data, including **documents, email credentials, and network access passwords**. The campaign focused on **data theft**, compromising the **supply chain** and targeting entities like **government institutions, military contractors, maritime/shipbuilding groups, telecom operators, satellite operators, and high-tech firms**. HMM, a key player in global shipping, faced **long-term intelligence extraction**, risking **operational secrets, proprietary maritime data, and potential disruptions to logistics networks**. The attack’s stealthy nature allowed sustained espionage, posing **strategic risks to corporate and national security** while undermining trust in critical infrastructure.
HMM Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for HMM
Incidents vs Maritime Transportation Industry Average (This Year)
No incidents recorded for HMM in 2025.
Incidents vs All-Companies Average (This Year)
No incidents recorded for HMM in 2025.
Incident Types HMM vs Maritime Transportation Industry Avg (This Year)
No incidents recorded for HMM in 2025.
Incident History — HMM (X = Date, Y = Severity)
HMM cyber incidents detection timeline including parent company and subsidiaries
HMM Company Subsidiaries
We are the global integrated logistics company that provides the utmost services through over a hundred vessels, the networks connecting the world, and our professional experts. As your friendly partner, we constantly strive to grow as a global shipping leader.
Loading...
HMM Similar Companies
Anglo-Eastern
Anglo-Eastern's rich maritime heritage spans over 50 years of ship management, crew management, cruise & leisure management and technical services. We manage a diverse fleet of vessels worldwide on behalf of our global partners, and uniquely offer both cadet and crew training through our highly rega
Hapag-Lloyd AG
About Hapag-Lloyd With a fleet of 313 modern container ships and a total transport capacity of 2.5 million TEU, Hapag-Lloyd is one of the world’s leading liner shipping companies. In the Liner Shipping segment, the Company has around 14,000 employees and 400 offices in 140 countries. Hapag-Lloyd has
Yacht Crew Register
Yacht Crew Register has been successfully recruiting professional captains and crew since 1995, and has developed a reputation for confidentiality. We are a private yacht crew agency serving yacht owners and select management companies. We guarantee complete confidentiality of all information entrus
.png)
HMM CyberSecurity News
November 18, 2025 08:00 AM
Are You Implying This Line Graph Isn’t a Compelling Cybersecurity Narrative?
Just because metrics are derived from cold hard facts doesn't mean we should present them as such. If CISOs don't frame their metrics to...
April 18, 2024 07:00 AM
Darktrace pitches to South Korean maritime giants
Cambridge cyber security AI world leader Darktrace has been pitching its technology to five of South Korea's largest shipbuilding and ship...
January 29, 2024 08:00 AM
Buckingham Palace seeks Cybersecurity Manager to safeguard Royal Family - Get the job, get a discount on a honey dipper!
Fancy a high-profile cybersecurity job? Here's one for you. Role: Cyber Security Manager. Location: Buckingham Palace.
April 28, 2022 07:00 AM
Boston College lineman selected in first round by AFC team
Johnson, a native of Bowie, Maryland, was selected by the Los Angeles Chargers with the 17th overall pick.
March 13, 2022 08:00 AM
Cyber security threat to shipping
The US Cybersecurity and Infrastructure Security Agency (CISA) has warned of future cyber attacks from Russia or pro-Russian groups,...
February 07, 2022 08:00 AM
New CyberSafe: Home Sweet Hmm Minecraft adventure aims to teach kids about online safety
Minecraft: Education Edition will tackle cyber security with CyberSafe: Home Sweet Hmm, which will teach children about protecting their safety on the internet.
September 24, 2021 07:00 AM
Port Houston targeted by suspected nation-state actor in cyber-attack
The Port of Houston Authority was targeted in a cybersecurity attack in August, believed to have originated from a nation-state actor.
September 20, 2021 07:00 AM
CMA CGM targeted by hackers in new cyber attack
French container shipping major CMA CGM has been hit by a new cyber attack targeting customer information.
August 19, 2021 07:00 AM
Port of San Diego: phishing emails remain amongst greatest cyber threats
Phishing emails continue to be one of the greatest threats to a port's cybersecurity. In 2021, ports and shipping stakeholders ranging from liner HMM to South...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
HMM CyberSecurity History Information
Official Website of HMM
The official website of HMM is http://www.hmm21.com.
HMM’s AI-Generated Cybersecurity Score
According to Rankiteo, HMM’s AI-generated cybersecurity score is 784, reflecting their Fair security posture.
How many security badges does HMM’ have ?
According to Rankiteo, HMM currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does HMM have SOC 2 Type 1 certification ?
According to Rankiteo, HMM is not certified under SOC 2 Type 1.
Does HMM have SOC 2 Type 2 certification ?
According to Rankiteo, HMM does not hold a SOC 2 Type 2 certification.
Does HMM comply with GDPR ?
According to Rankiteo, HMM is not listed as GDPR compliant.
Does HMM have PCI DSS certification ?
According to Rankiteo, HMM does not currently maintain PCI DSS compliance.
Does HMM comply with HIPAA ?
According to Rankiteo, HMM is not compliant with HIPAA regulations.
Does HMM have ISO 27001 certification ?
According to Rankiteo,HMM is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of HMM
HMM operates primarily in the Maritime Transportation industry.
Number of Employees at HMM
HMM employs approximately 3,275 people worldwide.
Subsidiaries Owned by HMM
HMM presently has no subsidiaries across any sectors.
HMM’s LinkedIn Followers
HMM’s official LinkedIn profile has approximately 128,167 followers.
NAICS Classification of HMM
HMM is classified under the NAICS code 483, which corresponds to Water Transportation.
HMM’s Presence on Crunchbase
No, HMM does not have a profile on Crunchbase.
HMM’s Presence on LinkedIn
Yes, HMM maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/hmmofficial.
Cybersecurity Incidents Involving HMM
As of December 18, 2025, Rankiteo reports that HMM has experienced 2 cybersecurity incidents.
Number of Peer and Competitor Companies
HMM has an estimated 2,134 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at HMM ?
Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack.
Incident Details
Can you provide details on each incident ?
Title: Hyundai Merchant Marine Cyber-Espionage Campaign (Kimsuky) via Fucobha/Icefog Backdoor (2010–2013)
Description: Hyundai Merchant Marine was targeted by North Korean attackers (APT group 'Icefog' or 'Fucobha') in a prolonged cyber-espionage campaign from April 2010 to 2013. The attack relied on spear-phishing and exploits for known vulnerabilities to deploy the 'Icefog' backdoor. The campaign, named 'Kimsuky,' focused on data theft, including documents, email credentials, and network access passwords. Victims remained infected for months or years, with continuous data exfiltration. The operation targeted supply chains, government institutions, military contractors, maritime/shipbuilding groups, telecom/satellite operators, industrial/high-tech companies, and mass media.
Type: cyber-espionage
Attack Vector: spear-phishingexploitation of known vulnerabilities
Threat Actor: IcefogFucobhaKimsuky (North Korean APT group)
Motivation: data theft (documents, email credentials, network access passwords) for espionage purposes
Title: HMM (Hyundai Merchant Marine) Phishing Attack and Email System Disruption
Description: In June 2021, South-Korea based HMM (Hyundai Merchant Marine) was hit with a virus due to a phishing attack, which infiltrated the email systems. The email servers in all areas except for America and Europe were impacted, rendering them unusable.
Date Detected: 2021-06
Date Publicly Disclosed: 2021-06
Type: Cyber Attack (Phishing, Malware)
Attack Vector: Phishing
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Cyber Attack.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through spear-phishingexploited vulnerabilities and Phishing (email).
Impact of the Incidents
What was the impact of each incident ?
Incident : cyber-espionage HMM702092025
Data Compromised: Documents, Email account credentials, Network access passwords
Incident : Cyber Attack (Phishing, Malware) HMM636092125
Systems Affected: Email servers (excluding America and Europe)
Downtime: Ongoing (as of disclosure, exact duration unspecified)
Operational Impact: Email systems unusable in affected regions
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Documents, Email Credentials, Network Access Passwords and .
Which entities were affected by each incident ?
Incident : cyber-espionage HMM702092025
Entity Name: Hyundai Merchant Marine
Entity Type: company
Industry: maritime, shipbuilding, logistics
Location: South Korea
Incident : Cyber Attack (Phishing, Malware) HMM636092125
Entity Name: HMM (Hyundai Merchant Marine)
Entity Type: Corporation
Industry: Shipping/Logistics
Location: South Korea
Data Breach Information
What type of data was compromised in each breach ?
Incident : cyber-espionage HMM702092025
Type of Data Compromised: Documents, Email credentials, Network access passwords
Sensitivity of Data: high (espionage-targeted, internal network access)
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : cyber-espionage HMM702092025
Entry Point: Spear-Phishing, Exploited Vulnerabilities,
Reconnaissance Period: prolonged (months to years)
Backdoors Established: ['Icefog/Fucobha backdoor']
High Value Targets: Government Institutions, Military Contractors, Maritime/Shipbuilding Groups, Telecom Operators, Satellite Operators, Industrial/High-Tech Companies, Mass Media,
Data Sold on Dark Web: Government Institutions, Military Contractors, Maritime/Shipbuilding Groups, Telecom Operators, Satellite Operators, Industrial/High-Tech Companies, Mass Media,
Incident : Cyber Attack (Phishing, Malware) HMM636092125
Entry Point: Phishing (email)
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : cyber-espionage HMM702092025
Root Causes: Spear-Phishing Success, Unpatched Vulnerabilities, Persistent Backdoor (Icefog/Fucobha),
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident was an IcefogFucobhaKimsuky (North Korean APT group).
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2021-06.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2021-06.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were documents, email account credentials, network access passwords and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident was Email servers (excluding America and Europe).
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were documents, network access passwords and email account credentials.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker was an Phishing (email).
What was the most recent reconnaissance period for an incident ?
Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was prolonged (months to years).
.png)
Latest Global CVEs (Not Company-Specific)
Description
Zerobyte is a backup automation tool Zerobyte versions prior to 0.18.5 and 0.19.0 contain an authentication bypass vulnerability where authentication middleware is not properly applied to API endpoints. This results in certain API endpoints being accessible without valid session credentials. This is dangerous for those who have exposed Zerobyte to be used outside of their internal network. A fix has been applied in both version 0.19.0 and 0.18.5. If immediate upgrade is not possible, restrict network access to the Zerobyte instance to trusted networks only using firewall rules or network segmentation. This is only a temporary mitigation; upgrading is strongly recommended.
Risk Information
cvss3
Base: 9.1
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists in the application's filter configuration. The CSRF protection mechanism was **explicitly disabled**, allowing the application to process state-changing requests (POST) without verifying a valid CSRF token. An unauthenticated remote attacker can exploit this by hosting a malicious web page. If a logged-in administrator visits this page, their browser is forced to send unauthorized requests to the application. A successful exploit allows the attacker to silently create a new Administrator account with full privileges, leading to a complete takeover of the system and loss of confidentiality, integrity, and availability. The vulnerability has been patched in version 3.4.2. The fix re-enables the CSRF filter in `app/Config/Filters.php` and resolves associated AJAX race conditions by adjusting token regeneration settings. As a workaround, administrators can manually re-enable the CSRF filter in `app/Config/Filters.php` by uncommenting the protection line. However, this is not recommended without applying the full patch, as it may cause functionality breakage in the Sales module due to token synchronization issues.
Risk Information
cvss3
Base: 8.8
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/Nixon-H/CVE-2025-68434-OSPOS-CSRF-Unauthorized-Administrator-Creation
- https://github.com/opensourcepos/opensourcepos/commit/d575c8da9a1d7af8313a1e758e000e243f5614ef
- https://github.com/opensourcepos/opensourcepos/pull/4349
- https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-wjm4-hfwg-5w5r
Description
Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Model Context Protocol (MCP) configurations from the `settings.json` file located within a project’s `.zed` subdirectory. A malicious MCP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE. This can be triggered automatically without any user interaction besides opening the project in the IDE. Version 0.218.2-pre fixes the issue by implementing worktree trust mechanism. As a workaround, users should carefully review the contents of project settings files (`./zed/settings.json`) before opening new projects in Zed.
Risk Information
cvss3
Base: 7.7
Severity: HIGH
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Description
Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Language Server Protocol (LSP) configurations from the `settings.json` file located within a project’s `.zed` subdirectory. A malicious LSP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE. This can be triggered when a user opens project file for which there is an LSP entry. A concerted effort by an attacker to seed a project settings file (`./zed/settings.json`) with malicious language server configurations could result in arbitrary code execution with the user's privileges if the user opens the project in Zed without reviewing the contents. Version 0.218.2-pre fixes the issue by implementing worktree trust mechanism. As a workaround, users should carefully review the contents of project settings files (`./zed/settings.json`) before opening new projects in Zed.
Risk Information
cvss3
Base: 7.7
Severity: HIGH
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Description
Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. For a project to potentially be vulnerable to this issue, it must build the Storybook (i.e. run `storybook build` directly or indirectly) in a directory that contains a `.env` file (including variants like `.env.local`) and publish the built Storybook to the web. Storybooks built without a `.env` file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than `.env` files. Storybook runtime environments (i.e. `storybook dev`) are not affected. Deployed applications that share a repo with your Storybook are not affected. Users should upgrade their Storybook—on both their local machines and CI environment—to version .6.21, 8.6.15, 9.1.17, or 10.1.10 as soon as possible. Maintainers additionally recommend that users audit for any sensitive secrets provided via `.env` files and rotate those keys. Some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, either prefix the variables with `STORYBOOK_` or use the `env` property in Storybook’s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle.
Risk Information
cvss3
Base: 7.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=hmmofficial' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
