Home / Industries / Cruise Lines and Maritime
Transportation Systems · Maritime · Cruise lines and fleets
A cruise ship runs a power plant, a bridge, life safety systems, and a hotel on one hull, and on many ships they share one satcom link to shore. Red Tiger Security assesses shipboard OT and IT without putting the ship at risk. The walk starts where the ship touches the outside world: satcom, shore connections, OEM remote access, and the hotel and guest networks. Then it works down to the field devices: propulsion drives, power management, ballast, fire detection, and watertight doors. After the assessment the team fixes what is hurting operations now. If you want Red Tiger to stay, the close is 24x7 MSP + Metrics and Reports.
Every event below comes from public filings, regulator decisions, company statements, or named press reports. Over these years the targets moved from shoreside IT and guest data toward terminals, satcom, and navigation. The cruise-line events were IT and guest-data incidents, not shipboard OT.
Malware hit Maersk Line, APM Terminals, and Damco. Maersk put the impact at USD 200 to 300 million. [11]
The shipbroker was breached through a single user account; data was copied and a ransom demanded. [12]
An attack on a vendor-hosted receipt system deleted the database and left a ransom note. 6,004 customers affected; Singapore's PDPC fined the company S$16,000. [14]
A travel agent portal was breached, exposing about 27,000 agent emails and passwords. NCL said no guest, employee, or payment data was involved. [15]
Ransomware encrypted part of one brand's IT systems and data files were downloaded, disclosed in an SEC Form 8-K. [16]
Ransomware cut external access; e-commerce was fully back Oct. 11. All four of the largest container lines had now been hit. [18,13]
Ransomware encrypted Costa systems; files with passport numbers and dates of birth were downloaded. [17]
USD 5 million for four cybersecurity events in 2019 to 2021, including two ransomware attacks. NYDFS cited gaps in MFA, reporting, and training. [17]
LockBit ransomware hit the system that runs all five container terminals. About three days to recover. [19]
Landside operations at four Australian ports were suspended after unauthorized access. [20]
Hacktivists claimed they cut VSAT links to 50 tankers and 66 cargo ships through their satcom provider. [8]
The container ship ran aground in the Red Sea; GPS interference was blamed. [22]
33 CFR 101 Subpart F takes effect. Reportable cyber incidents go to the National Response Center. [24]
Rhysida hit a major Japanese maker of radar, ECDIS, and voyage data recorders. [8]
What U.S. officials confirmed, and what is still unconfirmed.
Why it matters for cruise: Grable told CBS the barrier to tampering with shipboard machinery is "not necessarily that sophisticated," and pointed to network segmentation, phishing, and basic cyber hygiene. A cruise ship carries the same propulsion and navigation systems, plus thousands of guests and a large hotel network. [2] The first step is an independent, ship-level assessment of the IT to OT boundary, done plant-safe, so you know where each ship stands.
Four groups of systems share one hull, and on many ships they share one satcom link to shore.
Integrated automation system (IAS), power management and diesel-electric propulsion, azipods, engine control, ballast and stability, HVAC, fuel, water, wastewater, and AWP.
ECDIS, radar, GNSS, AIS, autopilot, voyage data recorder (VDR), dynamic positioning (DP), and thruster control.
Fire detection and suppression, watertight doors, emergency power, PA/GA, muster systems, lifeboat systems, and CCTV.
Hotel property management (PMS), point of sale, guest Wi-Fi, crew networks, satcom, medical systems, cashless and guest ID, reservations, and shore connectivity.
