The real threats in maritime cyber, ranked by what has actually happened

Ask a room of operators what maritime cybersecurity means and you get the movie: someone takes the helm from a laptop, a towboat turns hard to port, a barge full of benzene finds a bridge pier. It is a vivid picture, and it is almost entirely absent from the evidence.

What is in the evidence is duller and much more expensive. A fake invoice. A password that worked. A backup nobody had tested. This is what the record actually shows, ranked by how often each vector lands on a company that runs boats.

First, a word about receipts

Most cyber marketing runs on adjectives. This does not, so it is worth stating how the claims below are graded:

• Observed in the marine environment. The Coast Guard Cyber Command publishes an annual report — Cyber Trends and Insights in the Marine Environment — built from what its Cyber Protection Teams found inside real Marine Transportation System networks. The 2024 edition rests on 42 missions with industry partners. When it says something, that is an observation, not a survey.
• Documented maritime incidents. Named companies and ports with public reporting.
• Documented incidents in analogous industries, where the transfer argument is stated out loud — trucking and small utilities share a towing company's profile: thin IT staff, an operations floor that cannot stop, a one-person finance office.
• Research demonstrations only. Made to work under lab conditions, never observed against a real operator. Named as such, and ranked low.

That last category is where most of the scary maritime headlines live. Writing a research demo into a risk register as a crime wave is the fastest way to lose a port captain.

1. Someone logs in as you

The Coast Guard's own assessors put valid accounts — not malware — at the top of the observed record: legitimate credentials were the entry point in 42 percent of Marine Transportation System incidents in 2024. Not an exploit. Not a zero day. A working username and password, bought or phished, used at the front door.

The conditions that make it easy are equally well observed. Roughly 80 percent of the industry runs on Microsoft 365. Multifactor authentication, where it exists at all, is partial — and a good share of what exists can be bypassed. Default credentials were still in use at 71 percent of assessed organizations.

This is the cheapest attack in the catalogue and the most common, and the rule's answer is equally cheap: multifactor authentication, separate credentials for critical systems and business email, revocation when someone leaves — all in §101.650(a).

2. The invoice that was not from your fuel vendor

The highest-frequency, most-monetized vector in the entire record is business email compromise. An attacker takes over or imitates an email account in a payment conversation and reroutes a wire. The FBI's complaint center logged $2.77 billion in reported BEC losses in 2024. One cyber insurer's 2026 claims data puts BEC plus funds-transfer fraud at 58 percent of all claims, with an average funds-transfer loss around $141,000.

The maritime version has a name. At Svitzer Australia, a towage company, auto-forwarding rules planted on three mailboxes — finance, payroll, operations — quietly exported somewhere between 50,000 and 60,000 emails over roughly eleven months before anyone noticed in March 2018.

Barge freight settles by ordinary invoice and ACH transfer, approved by one controller, exactly like every other victim's. The rule's answer lives in §101.650(a) for the account, §101.650(d) for the training that reaches the person who pays, and §101.650(g)(1) for the report when it happens anyway.

The honest test for your own operation is not a policy document. It is this question: how does a vendor change their bank details with you? Do not tell us — show us how a $40,000 fuel invoice gets paid.

3. Ransomware on the office network

Ransomware accounted for about a quarter of reported Marine Transportation System incidents in 2024. The maritime cases are real: a Ryuk infection shut down an MTSA-regulated facility for roughly 30 hours in 2019, and the Port of Nagoya — Japan's busiest — lost two days of container operations in 2023.

The case worth memorizing is not maritime, and that is the point. KNP, a British haulage company, closed permanently in 2023 after a ransomware attack, and 730 people lost their jobs. A haulier is a towing company that drives: same thin IT bench, same operations floor that cannot pause, same margin.

What separated KNP from the companies that recovered was not detection sophistication or insurance. It was a password, and a backup nobody had tested. The rule prices both at nearly nothing: backups of critical systems, protected and frequently tested, under §101.650(g); and the drill and exercise cadence in §101.635 that makes you find out before an attacker does.

4. The way in belongs to someone you pay

A small operator's technology stack is majority vendor-operated — 73 percent of Marine Transportation System partners outsource security operations. That is usually good news for the quality of the work and unambiguously bad news for the size of the door.

Two receipts. Kaseya, 2021: one compromise of a managed-service tool reached roughly 1,500 downstream companies, none of whom were targeted individually. And in 2024, the Coast Guard documented the first shipboard ransomware case it had seen arrive through a weak VPN account — vendor remote access, straight aboard.

The rule treats this as a procurement problem, which is exactly right: cybersecurity as a purchasing criterion, vendors obligated to notify you of incidents without delay, and third-party remote connections monitored and documented — §101.650(f).

5. The USB stick in the wheelhouse

Cargo files move on thumb drives. They always have. A 2019 Coast Guard safety alert documented exactly this practice degrading a shipboard network.

The likelihood is moderate and the landing zone is disproportionate, because the receiving computer is often the one displaying the chart. §101.650(i) asks for OT physical access to be limited and logged, unused ports blocked or disabled, and §101.650(b) wants an approved hardware and software list that says what is allowed to be plugged in at all.

6. Crew wifi sharing a network with navigation

Always-on satellite internet arrived on inland boats fast, and the default install is one flat network. The Coast Guard now describes ships as "another segment of the enterprise network," and documented vessel servers being encrypted in a 2024 case.

We label this one honestly: the enabling condition is observed and the consequence is observed, but a public case of crew wifi being the specific entry point on an inland towboat has not surfaced yet. It is an inference bridging two documented facts, not a documented event. §101.650(h) — segment IT from OT, log and monitor what crosses between them.

What is not the threat, and why saying so matters

GPS jamming and AIS spoofing. Real, documented, and geopolitical: mass spoofing in the Black Sea in 2017, sustained jamming in the Baltic through 2024 and 2025. For a boat on the Lower Mississippi, inland navigation is visual and radar primary, and no domestic incident of this kind is in the record. Score it low, write down the reasoning, and keep your credibility for the vectors that matter.

The engineered spill. Internet-exposed operational technology is observed constantly — a water utility in Aliquippa, Pennsylvania was reached in 2023 through a programmable logic controller with the default password "1111." But hostile actuation — someone deliberately operating equipment to cause a discharge — has historically required insider knowledge, and no documented case of an engineered maritime spill exists anywhere. Exposure scores high. The sabotage endpoint scores low-likelihood and high-impact, and it is written down that way.

A vendor who cannot tell you which of those two sentences is which is selling you the movie.

The three sentences worth carrying

The marine environment's own assessors put valid accounts, not malware, at the top of the observed record. The cheapest controls in the rule answer the likeliest attack, not the scariest one.

The one company in this record that died — KNP, 2023 — died of a password and an untested backup. Both are things §101.650(a) and §101.650(g) price at nearly nothing.

And the one assessed operator that ignored its findings was ransomed within the year, through the same vulnerabilities its own assessment had already listed. That is the entire argument for the annual Cybersecurity Assessment in §101.650(e), made by the record rather than by us.

The rule is not asking you to defend against a movie. It is asking you to close the door someone actually walked through.