MCAD Maritime Cyber Attack Database
In December of 2024, the Danish navy monitored the Chinese bulk carrier Yi Peng 3 due to its potential involvement in damaging fiber-optic cables in the Baltic Sea. The ship had been near the damaged cables at the time of the incidents and had turned off its Automatic Identification System (AIS), making its exact route untraceable.
Dec, 2024In January 2024, the Philippine Coast Guard accused China of using AIS spoofing to mislead authorities. Evidence showed a Chinese vessel appearing in impossible locations over 60 days, with local residents reporting sightings. The Chinese government denied the claims amid rising South China Sea tensions.
Dec, 2024In August 2024, the 8Base ransomware group targeted Croatia’s Port of Rijeka in an attack involving encryption and data theft. The malware was used to disrupt port operations and demand a ransom. The group is known for sophisticated attacks on critical infrastructure, and the Port of Rijeka is the latest victim. Despite threats actors stealing some data, the incident had no impact on the operations of the port. The CEO, Mr. Grabovac, pointed out that his organization will not pay the ransom requested by the ransomware gang.
Dec, 2024In December 2024, Vallianz, a Singapore-based OSV owner, was hit by a ransomware cyberattack. The attack gave unauthorized access to its servers, but the company quickly engaged external experts to mitigate the damage and activate its business continuity plan. Preliminary assessments indicated no major impact on business operations. Vallianz is continuing its investigation into the attack and has warned its shareholders about the potential risks.
Dec, 2024In December 2024, Neda Maritime, a prominent Greek ship management company, was targeted by the Blackout ransomware group. The attackers exfiltrated around 150GB of sensitive data, including shipping logs and crew information, and encrypted the company's data while destroying backups. They threatened to release the stolen information unless a ransom was paid by December 23.
Dec, 2024Indonesia’s national oil firm PT Pertamina was compromised by Killsecurity ransomware in December 2024, endangering vital energy infrastructure.
Dec, 2024In December 2024, logistics giant Livingston International was affected by a Play ransomware attack, hampering its North American operations.
Dec, 2024December 2024 brought disruption to Maldives Ports Limited after a ransomware breach by Play, affecting key port container handling.
Dec, 2024December 2024 brought a ransomware incident to Overseas Shipholding Group in the U.S., reportedly launched by the Ransomhub group.
Dec, 2024The West Gulf Maritime Association in the U.S. faced a ransomware breach by Ransomhub in December 2024, affecting maritime coordination.