Cyber Incidents

WHAT cyber-attacks have already occurred?


Dirty Bomb Protection: (AAPA - Maritime Exec.)

 - mechanism to prevent cyber terrorism and the trafficking of nuclear materials 

- International Atomic Energy Agency (IAEA): 2,700 cases of illicit trafficking of nuclear materials since Dec. 31, 2014

- Dave Espie, Maryland Port Administration Security Director testimony: smuggling is increasing, need to protect against nuclear smuggling

- using human, cyber and technical assets


Enrico Ievoli (2011) (Piracy evolving)

- Carrying caustic soda from Persian Gulf to Med

- Italian mafia commissioned pirates: premeditated, knew itinerary, cargo, crew, location, no armed guards

- Online information

Pirates Hack Shipping Company (2016)

• Global shipping company hacked by pirates for several months

• Pirates would board a vessel, locate by bar code specific sought-after crates containing valuables, steal that crate (and that crate alone), and depart without incident

• Specific, targeted attacks


•Bunkering Sector:

• Highly susceptible

• Bunkering community targeted frequently - often industry insiders (over-reliant on email communications)

• Impersonate seller, send emails requesting payment be made to a different account = funds sent into scammer's account 

  • • World Fuel Services, 2014
  • • $18 million loss

Nautilus Minerals

• December 2014, engaged in a deal to order a sea floor mining vessel in China on the back of a long-term charter

• Pre-paid $10 million of the $18 million charterer's guarantee to Dubai-based Marine Assets Corporations ("MAC")

• Unknowingly paid $10 million into the account of a cybercriminal

Limassol-Based Shipping Company (2015)

• August 2015, received an email purportedly from their fuel supplier in Africa, requesting money owed be paid to a different account than usual

• Shipping company complied, paid roughly $644,000

 FRAUD - later received email from fuel company asking for payment

Charterer's Email Account Hacked (2016)

• Funds to pay agent went to Nigerian bank account

• Vessel was detained on the basis that Charterer's agents did not receive funds for port clearance

Broker's Email Account Hacked (2016)

• Hacker's accessed a broker's email system

• Sent email to shipping company requesting payment to a different bank account

• Shipping company did not verify, and complied

• RESULT: loss of $500,000 (forced to pay twice) 


- China's People's Liberation Army targeting marine shipping providers

- Spoof emails target companies to secure access to confidential data

2014 Report Issued by the US Senate's Armed Services Committee

- 50 successful intrusions on US Transportation Command contractors (Transcom) (12 month period)

- Transcom was only aware of 2 of the 20 successful intrusions that qualify as "advanced persistent threats"

- All of which were attributed to China and targeted at airlines or shipping companies

Oil rig stability/security - Houston, 2013

- Malicious software unintentionally downloaded by offshore oil workers:

• Malware brought aboard by laptops and USB drives infected on land

• Infected files downloaded from online sources through satellite (pornography, music piracy) - Incapacitated computer networks on rigs and platforms; 

Potential catastrophe: well blowout, explosion, oil spill

- financial damage

- environmental damage

- loss of human life