MCAD Maritime Cyber Attack Database
Year2020 |
MonthSeptember |
Reference number20200901 |
Impact areaShore |
Incident locationMarseilles |
Incident countryFrance |
Victim countryFrance |
Victim identityCMA CGM |
Victim TypeShipping Company |
MethodRansomware |
Attacker countryRussia |
One of the most popular ransomware attacks is the one on the large French Shipping Company CMA CGM. This cyber incident occurred in the end of September 2020 (Port Technology International Team, 2021). During the ransomware attack in September 2020, the cybercriminals from a group named ‘’Ragnar Locker Gang’’ stole personal data from clients using the Ragnar Locker ransomware and demanded a ransom before giving the data back to the company. In an email sent on the 27th of September and seen by researchers, the hacker requested the French carrier to contact it within two days via live chat and pay for the special decryption key. It was clear that the aim of the attack was financial gain. The exact price was not shared outside the company. Besides that, the company stated that their marine and port activities were still working normally. To prevent the ransomware from spreading to the rest of the worldwide network, the corporation quickly disabled its internet connection. As a result, all online booking services and requests for operations were suspended. For bookings and queries, customers were directed to their nearest local office. Even though the ports and boats remained operational, loading processes were hampered to some extent.
