MCAD Maritime Cyber Attack Database
Year2024 |
MonthMarch |
Reference number20240301 |
Impact areaShore |
Incident locationClearwater, Florida, USA |
Incident countryUSA |
Victim countryUnited States |
Victim identityMarineMax |
Victim TypeLuxury yachting company |
MethodRansomware |
In March 2024, MarineMax, a leading retailer of recreational boats and yachts, was targeted by the Rhysida ransomware group. The breach was first announced on March 12th, and the group posted samples of the stolen data, which include earnings reports, balance sheets, bank account wire transfers, customer databases, and other financial documents. Rhysida is demanding 15 BTC (approximately $950,000 to $1.007 million) as ransom. The company disclosed the cyberattack to the SEC, noting disruptions in its business operations due to containment measures. Rhysida is auctioning the stolen data on its Tor-based website, offering it exclusively to the highest bidder if the ransom is not paid. MarineMax's clientele, likely high earners, could be significantly impacted if sensitive information is leaked. The ransomware group is known for targeting various sectors and often uses phishing attacks and Cobalt Strike tools to breach networks. Researchers developed a decryption tool for Rhysida's encryption method in February 2024, but it is unclear if it remains effective. The extent of data sensitivity in the MarineMax breach is also uncertain.
