Cyber incidents in shipping are more common than many realise. Daniel Ng, CEO of CyberOwl, says better visibility, shared knowledge and basic cyber discipline can make the threat far more manageable.

Cybercrime in shipping has a visibility problem. The attacks happen, but most never become public. That leaves the industry caught between two unhelpful extremes: assuming the threat is not serious, or imagining it is so sophisticated and uncontrollable that there is little point trying to defend against it.

Daniel Ng, CEO of CyberOwl, believes both reactions come from the same problem: a lack of knowledge about what is actually happening.

“Cyber risk in the maritime sector is quite an obscured domain… only the very, very largest of cases make it out into the public sphere. So people don’t really know about the cyber events that take place.” he says.

The numbers he sees through CyberOwl give a different picture. Last year, the DNV group company dealt with 1,200 cyber incidents for its clients, a significant increase on the previous year. Around 90 per cent were low-impact, Daniel says, but the remaining ten per cent were medium to high impact – or could have become so if they had not been stopped.

“Every time I say that number, someone falls off a chair because they don’t realise the volume.” Daniel says.

The attacks nobody talks about

Part of the problem is reluctance to disclose what has happened. Companies may see a successful attack as embarrassing, and where there is no requirement to share the experience, many simply do not.

CyberOwl saw that first-hand in research carried out in 2023 into shipping companies known to have suffered significant ransomware incidents. Six companies were interviewed. Three had paid a ransom, with an average payment of US$3 million.

Payment did not guarantee a clean recovery. Daniel describes one company that paid US$3 million but still could not recover all of its data. In other cases, an attacker may demand further payment – a tactic he refers to as “double tapping”.

“You make a calculation that $3 million is worth it to continue operations. You make the payment, but there are no guarantees and no money-back return.” Daniel explains.

For the victim, the immediate pressure is obvious. For the wider industry, the silence has another consequence: other operators do not learn from what happened.

The threat is serious – but controllable

Daniel’s central message is not that shipping should be frightened of cybercrime. It is that the industry should understand it well enough to act.

“This is controllable. There are some really simple things you can do that will fundamentally reduce the risk by 80 or 90 per cent. If you look at the ways in which people are exploiting systems on board, there is a pattern to it.” Daniel says.

That does not mean every owner or manager should try to build a security operation capable of covering every threat. Cyberattacks evolve too quickly for most companies to keep every area of expertise in-house. Daniel argues for clear internal ownership combined, where necessary, with external support.

“Having somebody who’s responsible internally is critical – but you cannot expect that person to be able to cover all aspects of security.”

The model, he says, is similar to safety management: outside support may be extensive, but somebody inside the organisation still needs to own the responsibility.

Knowledge gets stronger when it is shared

The same principle applies across the industry. Daniel points to threat-sharing forums, data exchanges and government systems that allow cyber practitioners to understand emerging threats and learn from one another. Some communities operate on a quid pro quo basis: members gain access by contributing information themselves.

That matters because, however numerous the methods used by hackers may appear, the attacks still depend on finding weak points.

“There may seem to be an overwhelming number of hacking methods out there, but they all come down to where the soft point is. You need to identify and protect those points.” Daniel says.

When a cyberattack looks like equipment failure

One of Daniel’s biggest concerns is ransomware moving from IT systems into operational technology. In an office environment, an attack may announce itself with a ransom demand on a screen. On a ship, the same type of event could look very different.

If malware affects an engine management system, he says, there may be no obvious message. The crew may simply see equipment that appears to have failed. The instinctive response – unplugging a computer and restarting it – can then make investigation harder by removing the logs needed to reconstruct what happened.

“You don’t know it’s malware – you just know that it’s equipment failure.”

CyberOwl’s monitoring and emergency-response work includes onboard storage designed to preserve that history. The company also has a strategic cooperation with The Swedish Club, bringing together cyber insurance, cyber resilience and operational awareness for shipowners.

More connected, more exposed

The same tension runs through the wider digitalisation of shipping. Better connectivity, automation and remote access bring substantial operational and financial benefits. They also create more opportunities for attackers.

Daniel says CyberOwl saw the number of incidents increase by at least 30 per cent after Starlink compared with before it. His point is not that shipping should turn away from connectivity, but that modernisation needs to be accompanied by the right security measures.

“We can’t just hide in a box and say “let’s not modernise”, because there are a huge amount of financial and operational benefits from digitalisation and connectivity. We just have to do it right.”

Jamming and spoofing of AIS and GPS are part of that changing risk picture. Jamming is usually obvious because the signal disappears. Spoofing can be harder to detect. The most dangerous situation, Daniel says, is not necessarily the absurd position that shows a ship crossing mountains, but a subtle error that leaves those on board confident of a position that is wrong.

Focus on the attacks that happen every day

State-sponsored hacking attracts attention, but Daniel says it should not dominate the industry’s thinking. In his assessment, 99 per cent of incidents are not state sponsored. Once an attack genuinely enters state-sponsored territory, sovereign nations and other support systems are more likely to become involved.

For an individual company, he argues, the more practical priority is the much larger volume of criminal activity.

“We should be focusing most of our time dealing with the high-volume criminal stuff, because that’s really where we’re getting chipped away through a thousand paper cuts.” Daniel explains.

From “why?” to “how?”

Despite the growth in incidents and the pace of technological change, Daniel is optimistic. What encourages him is not that the threat is disappearing, but that shipowners and managers are increasingly taking responsibility for it.

“Ten years ago, we were having conversations like “why do I have to do anything about this?” but now we’re being asked – “how should I tackle this?” It’s a fundamental shift.” He says.

That shift matters because much of the risk, in his view, can be reduced through relatively basic action. Cybercrime will continue to evolve as ships become more connected and digital. The industry’s defence is therefore not a single technical fix, but the ability to keep learning, identify the weak points and act before an incident becomes something much bigger.