MCAD Maritime Cyber Attack Database
In April 2016, 280 fishing vessels were involved in a GPS jamming incident off the coast of South Korea. Hackers jammed the GPS signal in this area to hamper military movement. Some of the vessels' GPS signals died and others received false information. In some cases, the GPS showed the position of vessels that were sailing on the sea as apparently being on land. By blocking the GPS signal for over 3 days, a total of 280 ships had to return to the port.
Jan, 2016In January 2016, US Navy ships got hit by GPS spoofing in Persian Gulf, Iran. Spoofing is a cheap way of riling Western powers and giving Iran leverage in international affairs. US ships got seized by Iran after it got spoofed into Iranian waters. Iranian forces took the crew of two U.S. Navy riverine boats to Farsi Island. Capturing U.S. sailors in its waters on the day of the U.S. President’s major speech was a huge international coup for Iran. It came at a time when it was eager to divert national and international attention from its concessions on nuclear development and the huge amounts of its treasure that was still frozen in Western banks. Anonymous government officials have told USNI News that Iran did not “spoof” the boat crews into their waters by sending fake Global Positioning System (GPS) signals. Rather, it was because of the crew’s “misnavigation.
In March 2016, vessels got hit by a GPS jamming attack in the demilitarized zone that separates North and South Korea. The electronic jamming signals have come from five North Korean regions (Haeju, Yonan, Pyongyang, Kumgang and Kaesong). The jamming campaign being carried out by the regime of Kim Jong-un to cause provocation. Nearly 700 fishing vessels have been affected by the jamming. The jamming has also affected cell phone base stations. This is the fourth round of GPS jamming by North Korea since 2010. On April 1 South Korea warned North Korea to stop and vowed to take action if it continued amid heightened tension over the North’s nuclear and rocket tests.
In 2016, the port of Oakland got hit by a DoS attack. Russia targeted the Administrative site, however this did not affect the port’s transportation servers. The incident lasted seven hours.
In 2016, Daewoo Shipbuilding & Marine Engineering got hit by a hacking attack in South Korea. The North Korean attackers were looking for information, through espionage, related to the country’s submarine programs but also beached sensitive data on Aegis Class destroyers. The hackers obtained around 40,000 documents, including 60 classified military files. Daewoo has been hacked 2 times after this incident. The ships affected may include the destroyer Yulgok Yi I – a vessel that carries the U.S. Navy's Aegis Combat System.
Nov, 2015In November 2015, ThyssenKrupp was hit by a cyber attack in Germany. There were multiple hacking attempts with the German firm ThyssenKrupp saying there are 30 to 40 intrusion attempts every day. There is no evidence the hacks have been successful. The aim of the attacker(s) was the theft of highly sensitive information about the Royal Australian Navy's technical requirements for its new-generation submarines. There wasn't really an impact, but they forced TKMS, DCNS, Mitsubishi, Kawasaki HI to hand-deliver the most sensitive information to ensure its safety. It is not exactly clear what measures the company took during and after the incident.
Oct, 2015In October 2015, Red Funnel was hit by a phishing attack in Southampton, in the UK. A bogus email containing a MS Word file which contains a virus was sent to customers with the bank reference number 5838547. The fake booking confirmation emails were sent out from post@redfunnel.co.uk with the subject heading ‘Confirmation 5838547’. In case the containing file is opened, it will try running a macro which will installs all kinds of notorious things that make an attempt to embezzle the victim's credit card details in addition to his passwords. There is no indication that Red Funnel’s security systems was compromised.
Jul, 2015In July 2015, a Shipping Company was hit by a phishing attack in Limassol, Cyprus. The attackers pretended to be a bunker supplier (a company in Africa) and asked for the payment to be remitted to another bank account, in order to make money. The company complied, only to find out it had been defrauded when it later received an email from the real fuel company asking for payment. The bunker supplier, which were Polish criminals, stole $644.000 from the Shipping Company.
In the period between 2015 and 2016, a longliner fishing vessel called 'Corinthian Bay' goes dark in Heard Island & McDonalds Islands in Australia. The vessel got dark by disengaging it's tracking system near a protected Marine Reserve on 10 separate occasions over one year. By doing this, the vessel could conduct illegal activities like fishing in no-take protected areas or entering another country’s waters without authorisation.
Dec, 2014In December 2014, Nautilus Minerals, an underwater mineral exploration company, was hit by a Business Email Comromise attack in Dubai. An third party had launched a cyber attack, resulting in Nautilus paying the deposit into a bank account it believed to be MAC’s, but which MAC had subsequently advised was not its account. The campaign of the attacker(s) was financial gain. The consequence of this attack was a $10 million wire transfer between two companies that got intercepted by hackers. After the attack the company engaged a cyber-security firm to ensure the ongoing security of its and MAC’s networks, and to investigate the source of the cyber attack.