The maritime industry is witnessing a significant increase in cyber-related events, highlighting that cyber risk is no longer confined to shore-based IT systems. Increasingly, cyber security has become an operational concern that touches not only information technology, but also communications, navigation, vessel operations and business continuity.

The scale of the challenge is evident from data highlighted in the latest The Swedish Club cyber compass, which notes that DNV Cyber and CyberOwl were involved in managing more than 1,500 cyber incidents during the first six months of 2026 alone. While many incidents remain confidential, the volume demonstrates that cyber events have become a routine operational issue for shipping companies worldwide.

When a cyber attack may not be what is seems

Recent events have also illustrated how difficult it can be to distinguish genuine cyber threats from misinformation and disinformation. In August 2026, a very large crude carrier (VLCC) entering US waters was boarded by US Coast Guard officials and FBI cyber specialists following reports that the vessel may have been the victim of a serious cyber attack. A second vessel, an LNG carrier, was also investigated after similar allegations emerged.

The incidents attracted considerable international attention after maritime media received emails purportedly from crew members describing catastrophic cyber attacks onboard. The messages claimed that navigation, communication and control systems had been disabled and that critical vessel functions were being affected. Some reports subsequently linked the alleged attacks to the vessels’ transit through the Strait of Gibraltar and broader geopolitical tensions in the region.

However, subsequent investigations highlighted the complexity of assessing cyber incidents at sea. US authorities reported no operational disruption, physical danger to the crew, environmental impact or vessel instability. The vessel operator confirmed that cyber security assessments had been conducted and that the vessel had been cleared for normal operations while investigations continued. Cyber security experts also questioned whether the alleged compromise of operational technology systems was technically plausible, noting that modern vessels typically segregate operational and information technology networks.

A new challenge: cyber-enabled disinformation

While the facts remain under investigation, the incidents are significant for two reasons. First, they demonstrate the growing concern among regulators and authorities about cyber threats affecting vessels. The decision to deploy specialist cyber teams to board commercial ships reflects the increasing seriousness with which maritime cyber risks are being treated.

Second, the cases illustrate a broader challenge facing the industry: the emergence of cyber-enabled disinformation. Several cyber security specialists and industry organisations have suggested that maritime media may increasingly become targets for influence operations designed to exaggerate cyber capabilities, create uncertainty or shape narratives during periods of geopolitical tension. In an environment where information moves rapidly and cyber incidents often remain confidential, distinguishing fact from fiction can become a challenge in itself.

When cyber risk has physical consequences

At the same time, the possibility of cyber-attacks causing physical consequences remains a genuine concern. The grounding of the container vessel MSC Antonia in the Red Sea in May 2025 has frequently been cited in discussions surrounding GPS spoofing and electronic navigation interference. While no official investigation has concluded that cyber activity caused the incident, it has become an important example of the potential risks associated with manipulated navigation signals and electronic interference. Incidents affecting navigation systems could, in theory, contribute to collisions, groundings, cargo losses, pollution events and significant financial liabilities.

A changing threat landscape

The threat landscape is also evolving. Cyber experts continue to warn that shipping companies are increasingly exposed not only through their own systems, but also through connected suppliers, equipment manufacturers and remote support providers. As vessels become more connected and digitalised, protecting the entire maritime ecosystem becomes increasingly important.

Meanwhile, regulators and industry bodies are strengthening their focus on cyber resilience. New reporting and compliance requirements are emerging through initiatives such as the European Union’s NIS2 framework, updated US cyber regulations and ongoing work by the International Maritime Organization (IMO) on a dedicated maritime cyber security code. Classification societies have also introduced cyber-related requirements for new buildings, although industry stakeholders continue to debate implementation and consistency.

From IT risk to operational risk

Taken together, these developments demonstrate that cyber security is no longer simply an IT concern. It is an operational, safety and business risk that requires the same level of attention as traditional navigational, engineering and safety disciplines. For shipowners and managers, the question is no longer whether cyber incidents will affect the maritime sector, but how prepared their organisations are to prevent, respond to and recover from them, while also navigating an increasingly complex information environment where cyber threats and disinformation may coexist.

Responding when it matters

In today’s maritime environment, responding to a cyber incident is not only about restoring systems. It is also about understanding what has happened, separating fact from speculation and making informed operational decisions under pressure. Having access to the right expertise at the right time can therefore be just as important as the financial protection itself. Through The Swedish Club’s marine cyber insurance and partnerships with specialist cyber experts, members have access to support both in strengthening their resilience and in navigating an incident when it occurs.