Atlantic Council maps maritime cyber risk
A policy report examines systemic cyber risks across ships, ports, and cargo systems in the global maritime transportation system, citing past incidents like NotPetya and Ryuk.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This Atlantic Council report is a policy-oriented analysis of cybersecurity risk across the maritime transportation system (MTS), treating it as a 'system of systems' spanning ships, ports, and cargo. It categorizes systemic risk into human factors (social engineering, poor cyber hygiene, unauthorized/insider access, overcomplicated technology) and systems risk (OT/ICS, IT networks, PNT/GPS-AIS spoofing, and ransomware), drawing on historical incidents to illustrate each category.
The report cites well-known past events rather than new intelligence: the 2017 NotPetya attack on Maersk, the 2018 COSCO ransomware incident, the 2019 Ryuk attack on a US port facility disrupting cargo monitoring for 30 hours, 2020 ransomware hits on Carnival, CMA CGM, Garmin, Hurtigruten, Port of Kennewick, and Toll Group, plus the 2019 Holland America/Princess Cruises phishing breach. It also references OT-focused attacks such as Stuxnet, Shamoon (Saudi Aramco/RasGas), and Triton/Trisis, alongside long-documented weaknesses like default passwords on satellite terminals (Globalstar, SAILOR 900 VSAT) and GPS/AIS spoofing including reported Russian activity.
Overall, this is a retrospective and structural risk assessment rather than a report of new active threats, intended to inform maritime cybersecurity policy and industry coordination. Severity is assessed as low since it presents no new exploited vulnerability, active campaign, or fresh incident—only synthesis of historical case studies to support risk-based recommendations.
Mentioned in this report
Source reporting: https://www.atlanticcouncil.org/in-depth-research-reports/report/cooperation-on-maritime-cybersecurity-a-system-of-systems
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs