Russian Military Hackers Suspected in Cyber Intrusion Targeting MSC Ferry European investigators are examining a suspected cyber intrusion by Russian military hackers targeting a ferry operated by MSC-Mediterranean Shipping Company SA, the world’s largest container shipping group. The incident occurred over the weekend in the southern French port of Sète, where the vessel—part of MSC’s Grandi Navi Veloci unit—was immobilized on Saturday as authorities assessed potential risks to operational systems. The ferry resumed its voyage to Algeria on Sunday after confirming no critical systems were compromised. The breach attempt, which remains under investigation by French and Italian officials, is believed to be linked to Russia’s GRU military intelligence agency. Forensic analysis reportedly identified overlaps in tactics, techniques, and procedures (TTPs) with previous GRU operations, including those publicly attributed to Unit 29155 by U.S. agencies like the FBI and CISA. No official attribution has been made, and the Kremlin has not responded to requests for comment. The attack targeted the ferry’s office computer network, aiming to impersonate legitimate users, but failed to penetrate operational systems—such as navigation, propulsion, or the Automatic Identification System (AIS)—due to network segregation and restricted remote access. Investigators noted that while sabotage was averted, the incident underscores vulnerabilities in maritime cybersecurity, particularly the risk of physical access attacks for surveillance or long-term infiltration. This is not the first attempt against the vessel. In November, a Raspberry Pi device—a concealed miniature computer—was discovered connected to a shipboard system in a restricted area, triggering security alerts. A second device, found last week and paired with a cellular modem for remote access, was seized for forensic analysis. Authorities suspect a third device may still be active on another ship. The incident highlights growing concerns over cyber threats to global maritime trade, which carries the majority of world commerce. Disruptions in shipping networks could have cascading effects on supply chains, critical infrastructure, and sensitive military or commercial movements. While this attack was contained, it reflects a broader pattern of state-sponsored cyber espionage targeting high-value logistics assets.

Rising Cyber Threats Target the Global Shipping Industry The maritime sector is facing a surge in cyber attacks, driven by increased digitization, outdated infrastructure, and geopolitical tensions. With around 80% of global trade transported by sea, shipping has become a prime target for criminal gangs and state-backed hackers. Key Threats and Incidents Cyber criminals exploit vulnerabilities in aging ship systems many vessels average 22 years old through tactics like GPS spoofing, where hackers manipulate navigation systems to misdirect ships, risking physical damage. Man-in-the-middle attacks intercept communications, enabling fraud or data theft, while ransomware incidents have doubled in cost, averaging $550,000 per attack (2022–2023). In extreme cases, ransom demands reach $3.2 million. Notable incidents include the MSC Antonia, which experienced suspected GPS spoofing in the Red Sea, and attacks linked to Nigerian criminal networks, Russia, China, North Korea, and Iran. Hackers also exploit emissions-monitoring sensors and satellite services like Starlink to gain access. Industry Response The International Maritime Organization (IMO) introduced mandatory cybersecurity provisions in 2021, requiring ships to integrate risk management into safety systems. While awareness has grown, experts warn that anti-jam technology remains costly, and many vessels lack modern defenses. Impact Disruptions can cripple operations, inflate costs, and reduce shipping capacity. With attacks rising from 10 in 2021 to far higher numbers in recent years the industry is scrambling to close security gaps amid an increasingly connected, yet vulnerable, digital landscape.

In April 2020, the Geneva-based Mediterranean Shipping Company (MSC), one of the world’s largest shipping firms, fell victim to a targeted malware attack exploiting an engineered vulnerability. The assault was localized to a limited number of physical systems at MSC’s Geneva headquarters but triggered a data center outage, crippling critical operations. The company’s digital booking tool and official website were knocked offline, leaving customers unable to access essential services for approximately five days.The disruption severely impacted MSC’s ability to process shipments, manage bookings, and maintain customer communications, leading to operational paralysis and potential financial losses from delayed transactions. While the attack did not explicitly mention data theft or ransomware demands, the prolonged outage of core systems—including customer-facing platforms—highlighted the vulnerability of global logistics infrastructure to cyber threats. The incident also underscored a broader trend of escalating cyberattacks on shipping giants, raising concerns about supply chain resilience in the face of digital sabotage.