Maritime Cybersecurity: Why Ports Are the Next Target for State-Sponsored Attacks

Maritime cybersecurity encompasses the protection of port operational technology (OT), vessel navigation and control systems, cargo management platforms, and the communications networks that connect them. Ports are emerging as priority targets for state-sponsored cyber operations because they sit at the intersection of critical infrastructure, global supply chains, and national security — and because their defenses are, in many cases, years behind those of other critical sectors.

The NotPetya attack of 2017, which cost Maersk an estimated $300 million and shut down terminal operations across multiple ports for weeks, was not even specifically targeting maritime infrastructure. It was collateral damage from a Russian cyberattack aimed at Ukraine. The question is no longer whether a deliberate, targeted cyberattack on port infrastructure will occur, but when — and whether the maritime sector is prepared.

Why Are Ports Vulnerable to Cyberattacks?

Ports present a uniquely attractive target for several structural reasons.

Convergence of IT and OT Systems

Modern ports rely on operational technology — terminal operating systems (TOS), container handling equipment control systems, vessel traffic services, access control systems, and SCADA-based utility management — that was historically isolated from the internet. As ports have digitized and connected these systems for efficiency gains, they have created attack surfaces that did not exist a decade ago.

A terminal operating system that manages vessel berth allocation, crane operations, and gate processing is now typically connected to shipping line booking systems, customs platforms, and trucking portals. Each connection is a potential entry point.

Legacy Systems

Many ports operate critical systems that are 10 to 20 years old, running on unsupported operating systems with known vulnerabilities. Upgrading these systems is expensive and operationally disruptive, so patches are deferred, and legacy hardware remains in service well past its intended lifecycle.

Complex Supply Chain Ecosystem

A single port operation involves dozens of connected parties — shipping lines, terminal operators, freight forwarders, customs authorities, trucking companies, rail operators, and government agencies. Each participant has its own cybersecurity posture, and the weakest link defines the system's overall resilience. Supply chain attacks that compromise a trusted vendor can provide access to port systems without directly breaching the port's own defenses.

High Consequences of Disruption

A successful cyberattack on a major container terminal can halt cargo movement, creating cascading supply chain delays and economic losses measured in hundreds of millions of dollars per day. This high-consequence profile makes ports valuable targets for both state actors seeking strategic leverage and criminal groups demanding ransom.

What State-Sponsored Cyber Threats Target Ports?

Several state actors have demonstrated capability and intent to target maritime and port infrastructure:

China. US intelligence agencies have publicly attributed the Volt Typhoon campaign to Chinese state-sponsored actors who pre-positioned access in US critical infrastructure, including ports and maritime facilities. The objective appeared to be establishing persistent access that could be activated during a future conflict over Taiwan.

Russia. Beyond NotPetya, Russian cyber operations have targeted port logistics systems in Europe, particularly in countries supporting Ukraine. The Sandworm group, attributed to Russian military intelligence, has demonstrated the capability to attack industrial control systems.

Iran. Iranian state-sponsored groups have targeted port and maritime organizations in the Gulf region. In 2020, an attempted cyberattack on Israeli water infrastructure demonstrated Iran's willingness to target critical infrastructure control systems.

North Korea. The Lazarus Group and related North Korean cyber operations have targeted maritime shipping companies and port-adjacent financial systems, primarily for revenue generation through ransomware and cryptocurrency theft.

How Have Cyberattacks Affected Ports?

Notable incidents include:

• Maersk / APM Terminals (2017): NotPetya destroyed 49,000 laptops, 1,000 applications, and 3,500 servers. Terminal operations at 76 ports were disrupted for up to two weeks. Cost: $300 million.
• Port of San Diego (2018): Ransomware attack disrupted administrative systems, though terminal operations were largely unaffected.
• Shahid Rajaee Port, Iran (2020): A cyberattack attributed to Israel disrupted traffic management systems, causing multi-day congestion.
• Port of Houston (2021): A password-spraying attack targeted a web-based management platform. The attack was detected and mitigated before causing operational impact.
• DP World Australia (2023): A cyber incident forced the operator to disconnect systems, halting container operations at four major Australian ports for three days.
• Port of Nagoya (2023): A LockBit ransomware attack shut down the NUTS container terminal system for two days, disrupting Toyota's just-in-time supply chain.

What Should Port Operators Do About Maritime Cybersecurity?

The IMO's Resolution MSC.428(98) requires cyber risks to be addressed in ship and port facility safety management systems. BIMCO, along with other industry organizations, has published guidelines on maritime cyber risk management. The US Coast Guard has incorporated cybersecurity into MTSA facility security assessments. But compliance with these frameworks is the floor, not the ceiling.

Effective maritime cybersecurity requires:

• Network segmentation between IT and OT systems, ensuring that a breach in the corporate network cannot propagate to terminal operating systems and equipment control.
• Continuous monitoring of both IT and OT networks for indicators of compromise, using security operations center (SOC) capabilities designed for industrial environments.
• Incident response planning that specifically addresses OT scenarios — how to operate a terminal manually when the TOS is offline, how to manage gate operations without automated systems.
• Supply chain security assessment and contractual requirements for all connected parties.
• Regular penetration testing of both IT and OT environments by teams with maritime domain expertise.

Key Takeaways

• Ports are high-value targets for state-sponsored cyberattacks due to their critical infrastructure status, legacy system vulnerabilities, and high-consequence disruption potential.
• State actors including China, Russia, Iran, and North Korea have demonstrated capability and intent to target maritime infrastructure.
• Notable attacks on Maersk, DP World, and the Port of Nagoya demonstrate that the threat is real and the consequences are severe.
• Effective defense requires network segmentation, continuous OT monitoring, incident response planning, and supply chain security.
• IMO, BIMCO, and national authorities are strengthening cybersecurity requirements, but port operators must go beyond compliance to achieve genuine resilience.