What really happened when ransomware hit maritime companies

Ransomware coverage runs to two extremes: vendor marketing that treats every operator as one click from ruin, and operator skepticism that treats the whole subject as hype. Both are wrong in the same way — neither looks at the record. So here is the record: three verified incidents, with years, causes and outcomes, chosen because together they answer the question an inland operator actually has. Not "could this happen" — it has — but "what decides how bad it is."

The pattern in all three is the same. An intruder gets a foothold in the shoreside network — a phishing link, a guessed password, an exposed remote service — encrypts the systems the business runs on, usually after stealing data, and demands payment. The boats keep moving on VHF and paper. Dispatch, billing and payroll do not.

2019: the facility that went dark for thirty hours

The Coast Guard's own documented case. In December 2019, a Marine Safety Information Bulletin described a Ryuk ransomware intrusion at an MTSA-regulated facility — entry through an email phishing link, encryption of the enterprise IT files, and then the part that made it a Coast Guard bulletin: the infection burrowed into the industrial control systems that monitor cargo transfer and disrupted the cameras, the physical access control and the process-monitoring systems. The facility shut down primary operations for over thirty hours.

Read carefully, the case is about connectedness, not sophistication. One click in the office reached the systems watching the dock, because nothing meaningful stood between them. That is precisely what the rule's segmentation measure exists to interrupt (§101.650(h)) — and the loss, note, came through monitoring going dark, forcing a conservative shutdown. Nobody manipulated a valve. They did not need to.

2023: the company that did not survive

KNP Logistics Group — the United Kingdom haulage firm behind the 158-year-old "Knights of Old" brand — was breached in June 2023 when the Akira gang brute-forced one employee's weak password on a network without multifactor authentication. The attackers encrypted the group's systems and demanded a ransom reported as high as five million pounds. The company could not recover its data or its operations. By September 2023 it was in administration. Roughly 730 people lost their jobs.

A century and a half of operating history did not survive one password. We include a trucking company in a maritime list deliberately, because a haulage group is a towing company with wheels: dispatch-centered operations, thin IT, family ownership, and no invoicing while the systems are down. The attack that ended KNP transfers to a towboat operator's stack — dispatch platform, QuickBooks, Microsoft 365 — without modification.

2023: the company that did

Estes Express Lines, the large American freight carrier, was penetrated in late September 2023; intruders were inside from September 26 and discovered on October 1, and the LockBit gang claimed the attack. Estes refused to pay. It kept freight moving on manual workarounds, restored its systems by October 24, and notified more than 21,000 people whose data had been stolen.

Three weeks of manual operations and a painful data-breach notification — a bad month by any measure, and a survivable one. Estes is the controlled experiment against KNP: comparable attack class, same year, opposite outcome. The variable was not luck, size alone, or paying. It was that recovery had somewhere to recover from — backups that existed and worked, and an organization that had thought about operating degraded before it had to.

What the record says, without dramatizing

The wider maritime data supports what the three cases show. The Coast Guard's cyber assessors reported ransomware as a quarter of reported marine transportation system incidents in 2024. Their most instructive case that year was an operator their teams had assessed in 2023 — overprivileged accounts, weak passwords, patch gaps, weak segmentation, all named in the findings — that did not fully address them and was ransomed in 2024 through some of the same vulnerabilities the assessment had already listed. The argument for taking an assessment seriously, made by the record itself.

Two calibrations, so this stays honest in both directions. Median ransom payments have run around $140,000 to $150,000 — for most operators a survivable number, which is why the ransom itself is rarely the real loss. The real loss is the outage: weeks of dead dispatch and billing, demurrage accruing, and the slow rebuild. And on the other side: none of these cases involved vessels being taken over. The 2019 facility case is the observed maritime OT consequence to date, and it was monitoring loss forcing a prudent shutdown. The record does not support fear of ghost boats. It thoroughly supports fear for your office.

What the rule prices at nearly nothing

Set the rule's requirements beside the three outcomes and the alignment is hard to miss:

• Backups, protected and frequently tested, and a Cyber Incident Response Plan that gets exercised (§101.650(g)) — the exact variable that separated Estes from KNP. An untested backup is a hope, not a control.
• Segmentation between IT and OT, with connections logged (§101.650(h)) — what would have kept the 2019 office infection away from the dock's monitoring systems, and what keeps a shoreside event off your boats.
• MFA, account lockout, no default passwords (§101.650(a)) — KNP's entire cause of death, priced at roughly nothing.
• Patching known exploited vulnerabilities without delay (§101.650(e)) — the lesson of the assessed-then-ransomed operator.
• Drills and exercises (§101.635) — because the first time your people run the response plan should not be the night it is real. A reportable incident, when one happens, goes to the National Response Center without delay (§101.650(g)(1)).

The facts are enough. One company in this piece died of a password and an untested backup; one absorbed the same class of attack and shipped freight through it; one federal bulletin documents how an office click became thirty dark hours at a regulated dock. The rule, whatever else it is, is a checklist written against exactly these three stories — and the resilience obligations are explained plainly at /the-rule/technical-measures, with the incident-reporting duty at /the-rule/incident-reporting and the response-plan documents in the downloads.

If you want to know which of these three stories your fleet is currently positioned to live through, book a readiness call at /book.