On 25 November 2021, the marine services provider SPO fell victim to a CLOP ransomware attack orchestrated by the Russian-based CLOP Gang. The attack involved the encryption of files using a variant of the CryptoMix ransomware family, which exploited vulnerabilities to bypass security measures. The attackers exfiltrated sensitive data, including full names, company details, locations, phone numbers, email addresses, bank information, and passport scans of employees. The breach primarily affected 2,500 employees across 18 countries, with the highest concentration of victims in Singapore and Malaysia, followed by China, the Philippines, and the UK. The compromised records belonged to both seafaring and onshore workforce, exposing personal and financial details. While the attack did not disrupt SPO’s global operations, the exposure of such data poses significant risks, including identity theft, financial fraud, and reputational damage. SPO responded by strengthening security protocols, collaborating with cybersecurity experts to investigate the incident, and implementing measures to mitigate future risks. The motive behind the attack remains unclear, but the data theft and ransomware deployment indicate a targeted effort to exploit sensitive corporate and employee information for potential extortion or malicious use.