This year, Cybersecurity Awareness Month turned into ‘black October’ amidst growing cyber threats and global cyber terrorism. Thirty eight shipping and ports groups were hit with a data leak threat on 14 October. Then in early November, seven countries felt the heat as fridges and freezers went into meltdown.
Earlier this week, Maersk identified an IT security incident involving unauthorised access and data extraction from one of its local legacy systems from a previous acquisition. The company says swift action was taken to secure the affected system and it believes no sensitive data was disclosed – this happened nearly a decade after the NotPetya attack (see below) that cost the company up to $300m.
Back in 2023 Brunswick Corporation paused operations in some locations following an IT security incident which impacted some of its systems and global facilities. Earlier in the year, the German shipbuilder Lürssen, which makes luxury superyachts and military vessels, was targeted by a ransomware cyberattack. The attack brought large parts of Lürssen’s shipyard operations to a standstill.
The weakest link in the supply chain
“We’re only as strong as our weakest link,” says Tom Bebbington (pictured), industry engagement & strategic partnerships lead at Tigris. His company builds adaptive infrastructure to connect fragmented operational data across shipping, ports, and global supply chains.
Bebbington says that the shipping industry – and wider marine – is one global, messy, tech-sprawl, full with a broad network of suppliers, manufacturers, warehouses, carriers, distributors and customers. Companies use different software, communication channels and security practices. Information frequently crosses organisational boundaries, often through a combination of established digital integrations and manual processes.
All this invisible infrastructure creates opportunities for phishing, invoice fraud and business email compromise.
A convincing message containing altered payment details or fraudulent delivery instructions can be difficult to distinguish from legitimate correspondence – especially when information is scattered across multiple channels and there is no consistent way to verify it.
MIN regularly receives emails from companies highlighting data leaks and phishing scams in their names. This problem reaches deep into all marine sectors’ inboxes.
But the “sprawl” has created an opportunity for Tigris. Its adaptive infrastructure – an operational data layer designed to connect fragmented systems, teams, and workflows – can link legacy tools, spreadsheets, documents, and partner data into an evolving environment that moves and structures information between existing platforms. The system’s also scalable; as businesses add new partners, workflows, and technologies, its modular data environment can be adapted. (Information about the system is available on the company’s website.)
Fragmented data creates cyber vulnerabilities
“When information is fragmented across emails, spreadsheets and disconnected applications, it becomes harder to establish a reliable picture of normal activity,” Bebbington argues.
“An unexpected change to an order, an unusual transaction or a discrepancy between a shipment notice and a delivery record may go unnoticed because the relevant information sits in separate systems.
“Connecting operational data can help organisations establish clearer records of activity and understand how an issue in one part of the network could affect others. It can also support faster investigation by making relevant information easier to trace across the supply chain.”
Connectivity must come with security
Supply chain cybersecurity requires an understanding of how information moves between organisations, who can access it and what happens when that information can no longer be trusted.
“The issue is not that email or spreadsheets are inherently insecure in every circumstance,” he notes. “Rather, when they become the connective tissue of complex operational processes, organisations can struggle to maintain consistent access controls, traceability and oversight across the entire process chain.”
For IT and operations leaders, the challenge is to connect cybersecurity with operational resilience. Protecting systems matters, but so does ensuring that the information used to make business-critical decisions remains accurate, accessible and secure.
Making operational data part of critical infrastructure
However, connectivity alone is not a security solution. “Integrating systems without appropriate safeguards can introduce additional risks, particularly when access permissions are too broad or connections between partners are poorly managed.
“Secure, connected data therefore needs to be supported by appropriate identity and access management, strong authentication, encryption, monitoring and clearly defined responsibilities for data sharing.
“Organisations must know which partners and users can access particular information, what changes they are authorised to make and how suspicious activity will be detected.
“The objective is to ensure that the right information reaches the right people and systems, through a controlled and auditable process.”
Local cyber incidents can become global disruptions
A compromised account, manipulated shipment record or unavailable system can affect several interconnected organisations at once. If a warehouse cannot verify an order, a manufacturer cannot confirm the availability of components or a carrier receives conflicting delivery instructions, the resulting disruption can spread well beyond the original point of failure.
In May this year, cruise operator Carnival detected a cybersecurity incident involving a compromised account of an employee. That led to a leak of names, addresses and government-issued identification numbers.
“A cyber incident can affect the provision of essential goods around the world,” Bebbington points out. In August 2026, ports in North Carolina were hacked by an outsider group and in September a cyber attack disrupted operations at Malaysia’s Port of Tanjung Pelepas.
Then there’s the 2017 ransomware attack on Maersk, estimated to have had a financial impact of US$300 million. 45,000 PCs and 4,000 servers were infected and 76 global port terminals were shut down, according to a key learnings report.
“One phishing email that gets through in a warehouse can disrupt the global shipping operations at the Port of Shanghai,” warns Bebbington.
As supply chains become more complex and businesses face increasing pressure to operate with greater speed and resilience, secure data connectivity must become part of the cybersecurity conversation, he stresses.
“The organisations best placed to withstand disruption will be those that treat operational information as critical infrastructure, protecting not only the systems that hold it but also the connections through which it moves.”
The post Supply chain’s biggest cyber blind spot? Logistics’ invisible infrastructure appeared first on Marine Industry News.